CyberRota Analysis
AI-GeneratedRodauth versions prior to 2.46.0 are vulnerable to an authentication bypass in the webauthn_login route, allowing logged-in users to impersonate any other account due to flawed session account identifier logic. This vulnerability poses a significant risk as it can lead to unauthorized access to user accounts. Organizations utilizing Rodauth should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.