Authentication Bypass in Rodauth WebAuthn Login

Rodauth, an authentication framework for Ruby applications, contains a critical authentication bypass vulnerability (CVE-2026-82466) in the webauthn_login route. The flaw affects all versions prior to 2.46.0. An attacker who is already authenticated as a low-privileged user can exploit this vulnerability to impersonate any other account within the application.

The issue arises from flawed account resolution logic within the WebAuthn authentication flow. Instead of enforcing a strict binding between the provided WebAuthn credential and the intended target account, the application incorrectly falls back to session-based identifiers. This behavior allows an attacker to complete the authentication process for a different user without possessing their valid credentials. This vulnerability poses a significant risk to the integrity and confidentiality of user accounts in applications relying on Rodauth for WebAuthn-based authentication.

Impact

Successful exploitation allows for full account takeover, enabling unauthorized access to any user profile, associated private data, and administrative functions. The scope of impact is limited to applications utilizing the Rodauth framework with the webauthn_login route enabled.

Recommendation

• Upgrade the Rodauth framework to version 2.46.0 or later to apply the security patch for CVE-2026-82466.
• Review application access logs for an unusual frequency of WebAuthn authentication successes by users that do not correlate with expected session activity.
• Audit custom authentication logic that integrates with Rodauth to ensure credential binding is strictly validated server-side.