Description
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jeremyevans | rodauth | < 2.46.0 | 2.46.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rodauth | 2.46.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-rodauth | No fix yet | — |
References
- Patch Commit patch
- GitHub Security Advisory (GHSA-3pvr-v35r-4r75) vendor-advisory
- https://github.com/jeremyevans/rodauth product
- VulnCheck Advisory: Rodauth before 2.46.0 Authentication Bypass via webauthn_login third-party-advisory