AIKIDO-2026-597496

TL;DR

The json feature matches request content types with a regexp that is not anchored to the start of the Content-Type header. A request can present application/json as a parameter of another content type so it is treated as a JSON request, which Rodauth exempts from CSRF checks by default on the assumption that such requests require a CORS preflight. This lets cross-origin form submissions bypass CSRF protection, and for endpoints that do not require a login it can force authentication into a chosen account. The fix anchors the default content-type regexp with the start-of-string anchor so only genuine JSON content types skip CSRF checks.