CVE-2026-82468CWE-352csrf

CVE-2026-82468

Medium · published August 29, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
4.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-29T21:17Z
References (4)
https://github.com/jeremyevans/rodauth · [email protected]https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8a8258aa57a · [email protected]https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hh2f-xw94-5p79 · [email protected]https://www.vulncheck.com/advisories/rodauth-before-2.47.0-csrf-protection-bypass-via-content-type · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 16:35Z
    Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
    cvelistv5