AIKIDO-2026-426323
rodauth is vulnerable to Authentication Bypass
94
Critical Risk
This Affects:
rodauthTL;DR
The webauthn_login feature determines the account used for authentication by falling back to the currently logged-in account identifier across all routes. When the feature is enabled, a user who is already authenticated can visit the webauthn login page and complete the flow as any other account, resulting in account takeover. Exposure exists because the default configuration does not halt or redirect already-authenticated requests to authentication routes. The fix restricts the logged-in account fallback to login-related routes so the feature can no longer be used to impersonate other accounts.
Who does this affect?
You are affected if you are on a version in the vulnerable range and the webauthn_login feature is enabled without halting or redirecting already-authenticated requests to the login routes (the default configuration does not halt them via already_logged_in). Because webauthn_login operates as single-factor authentication by default, any user who can authenticate their own account and complete a WebAuthn assertion can then log in as any other account.
Background info
rodauth is vulnerable to Authentication Bypass in versions 0.0.1 - 2.45.0.
How to fix this
Upgrade the rodauth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant