CVE-2026-82468

Medium

Description

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

SeverityMedium

CVSS4.7

Exploit probability—

ProductJeremyevans Rodauth

PublishedAug 29, 2026

First seenAug 29, 2026

Weakness typeCWE-352Cross-site request forgery (CSRF)

How to fix

Update

jeremyevans rodauth2.47.0 or later

Patches

github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8a8258aa57a

Vendor advisories

github.com/jeremyevans/rodauth/security/advisories/GHSA-hh2f-xw94-5p79

Affected products

Product	Affected versions	Fixed in
jeremyevans rodauth	v < 2.47.0	2.47.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.