CVE-2026-82466

CVE-2026-82466 is an authentication bypass (CWE-287) in the webauthn_login route of the Rodauth Ruby authentication framework, affecting all versions before 2.46.0. When processing a WebAuthn login, the route falls back to account identifiers already present in the user's session instead of validating that the presented credential is actually bound to that account, so a logged-in user can complete WebAuthn authentication as an arbitrary different account. A successful attacker thereby impersonates any other user, including privileged accounts, inheriting the victim's full access (high confidentiality and integrity impact per the CVSS 4.0 vector). Only Rodauth deployments that expose the webauthn_login route are affected, and the critical 9.4 score reflects high network-exploitable impact under certain attack preconditions (AT:P), such as an established authenticated session. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Rodauth to version 2.46.0 or later. If immediate upgrade is not possible, disable or restrict the webauthn_login route and review authentication logs and sessions for signs of cross-account impersonation. Applications not using Rodauth's WebAuthn login feature are not affected.