Description

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-29T17:17:59.057Z",
  "pubdate": "2026-08-29T17:17:59.057Z",
  "executiveSummary": "Rodauth versions prior to 2.47.0 are susceptible to an open redirect vulnerability stemming from improper validation of user-supplied return-to paths.\nThe vulnerability affects critical authentication-related workflows, specifically the confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features.\nBy manipulating return paths with protocol-relative URLs (e.g., //attacker.com), an unauthenticated or authenticated attacker can force a victim's browser to redirect to an arbitrary domain following a successful authentication or sensitive action.\nThis flaw facilitates phishing and social engineering attacks, as users are redirected to malicious sites under the guise of an expected application flow, potentially leading to credential theft or secondary malware delivery.\nThe vulnerability is reachable via standard web interaction and does not require elevated privileges, representing a significant risk to user trust and session security.",
  "technicalDetails": "The root cause of this vulnerability is the failure of Rodauth's internal redirection logic to properly sanitize or validate paths provided in the 'return_to' parameter. The application logic accepts string inputs meant for internal routing but fails to perform sufficient checks to distinguish between absolute, relative, and protocol-relative paths.\nIn web browsers, strings starting with double slashes (//) are interpreted as protocol-relative URLs, meaning the browser will interpret the remainder of the path as a domain name while maintaining the current protocol (http or https).\nThe vulnerability manifests within the confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location functions. When a user initiates a request containing a malicious return-to path, the application stores this path and utilizes it to redirect the user upon the successful completion of an authentication challenge or password verification.\nThe attack flow follows a predictable sequence: First, the attacker crafts a URL containing a crafted 'return_to' parameter, such as //malicious-site.com. Second, the attacker induces a victim to navigate to the application using this URL. Third, the victim performs the necessary authentication or security action (e.g., re-entering a password). Fourth, upon verifying the user's input, the Rodauth application executes a redirect command using the attacker-supplied, unvalidated string. Finally, the victim's browser resolves //malicious-site.com as a valid URL under the current protocol and navigates the victim to the adversary-controlled server.\nThis behavior bypasses standard application-level path validation that assumes local routing. Because this occurs post-authentication, the redirected user may falsely trust the destination site due to the successful completion of the preceding security process. The impact is significant as it facilitates sophisticated phishing maneuvers and allows for the masking of malicious destinations behind legitimate authentication workflows."
}