Description

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-29T17:17:58.910Z",
  "pubdate": "2026-08-29T17:17:58.910Z",
  "executiveSummary": "Rodauth versions prior to 2.46.0 contain a critical authentication bypass vulnerability within the webauthn_login route. This flaw permits an already authenticated user to impersonate any other account within the system by exploiting improper account resolution logic.\nThe vulnerability stems from the application's reliance on existing session account identifiers during the WebAuthn authentication process, rather than strictly validating the cryptographic binding between the provided WebAuthn credential and the intended target account. This leads to a broken access control scenario where the authentication state is improperly resolved.\nThe impact of this vulnerability is severe, as it grants unauthorized access to arbitrary user accounts, potentially leading to full account takeover, data exfiltration, or unauthorized administrative actions. Exploitation requires the attacker to possess an active session within the application. Given the nature of the flaw, the risk implication is significant for multi-user environments where account isolation is a fundamental security requirement.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of account resolution logic within the webauthn_login route in Rodauth. During the WebAuthn authentication flow, the application is responsible for identifying the account context against which a credential assertion is validated. In vulnerable versions, the logic erroneously defaults to referencing the account identifier present in the current session if the credential-to-account mapping is not explicitly and strictly bound.\nThe attack flow begins when an attacker, who has already established a legitimate session with their own low-privilege account, initiates a WebAuthn login request. By manipulating the request parameters or exploiting the fallback mechanism, the attacker triggers the authentication routine to process the WebAuthn assertion while the application context is still tethered to the existing session identifier. Because the code fails to verify that the WebAuthn credential being presented is cryptographically bound to the target user account, the application incorrectly authorizes the session as the target user.\nThe vulnerable component is specifically the handling of the WebAuthn assertion processing logic within the webauthn_login route. By failing to force a re-validation or isolation of the account context based on the specific credential handle, the application allows the session state to be hijacked by the attacker's existing authenticated state. Effectively, the application confuses the 'authenticator' identity with the 'session' identity.\nThis vulnerability is classified as an authentication bypass through improper account resolution. Since it requires the attacker to have an active session, it assumes a post-login state but permits lateral movement or vertical privilege escalation by assuming the identity of any other registered user. The vulnerability does not require external network exposure beyond the standard web interface of the Rodauth-enabled application. Successful exploitation leads to a complete compromise of the targeted account's session, allowing the attacker to perform any actions permitted to the victim user, including password changes, data modification, or account deletion, depending on the application's internal permissions model."
}