CyberRota Analysis
AI-GeneratedRodauth versions prior to 2.47.0 are vulnerable due to improper validation of protocol-relative return-to paths in key authentication features, allowing attackers to manipulate URLs with leading double slashes. This flaw can lead to unauthorized redirection of authenticated users to malicious sites after login or password confirmation. Organizations utilizing Rodauth should prioritize patching to mitigate the risk of phishing attacks and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.