CyberRota Analysis
AI-GeneratedRodauth versions prior to 2.47.0 are vulnerable to an authentication bypass in the jwt_refresh route, allowing attackers to obtain new JWT access tokens without a valid refresh token. This flaw enables unauthorized users to gain indefinite access to accounts by exploiting non-POST methods to present an access token. Organizations using Rodauth should prioritize patching this vulnerability to mitigate the risk of unauthorized account access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.