Description

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-29T17:17:59.213Z",
  "pubdate": "2026-08-29T17:17:59.213Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) protection bypass exists in Rodauth versions prior to 2.47.0. The vulnerability resides in the application's JSON request content-type validation logic.\nBy crafting a request with a specially formatted content-type header, an attacker can circumvent CSRF security controls. This allows the forced execution of unauthorized actions, such as forcing a victim to authenticate into an attacker-controlled account, leading to session fixation or account takeover.\nThe vulnerability poses a significant risk to user integrity and session security, as it bypasses the primary defensive mechanism intended to prevent cross-origin request forgery. Successful exploitation requires no prior authentication by the attacker, though it requires the victim to be authenticated to the target application and perform an action on a malicious site.\nThis flaw underscores the critical nature of strict content-type validation in web application security frameworks.",
  "technicalDetails": "The vulnerability is rooted in an inadequate validation mechanism within Rodauth's CSRF protection layer concerning JSON request content types. The system attempts to determine whether a request should be exempt from standard CSRF token validation based on its perceived content type. However, the implementation utilizes an insecure substring matching approach when evaluating the 'Content-Type' header of incoming HTTP requests.\nSpecifically, the validation logic fails to enforce strict equality against 'application/json'. Instead, it permits any 'Content-Type' string that contains 'application/json' as a substring. An attacker can exploit this by crafting a cross-origin HTTP POST request where the 'Content-Type' header is set to a value such as 'application/json.example.com' or other variations that include the required substring but differ from the expected media type.\nThe attack flow typically involves an attacker hosting a malicious web page that triggers an asynchronous request (via XHR or Fetch API) to the vulnerable Rodauth-protected application. Because the browser allows cross-origin requests that might be considered 'simple' under certain conditions, or if the server-side configuration is overly permissive, the request reaches the Rodauth middleware. Rodauth inspects the malicious 'Content-Type', identifies the presence of the 'application/json' substring, erroneously marks the request as a legitimate JSON-based API call, and subsequently skips the mandatory CSRF token verification.\nBy bypassing the CSRF token requirement, an attacker can force the victim's browser to execute state-changing operations on the target application. A primary use case for this vulnerability is forcing the victim to associate their session with an attacker-controlled identity, effectively performing a 'login CSRF' or 'session fixation' attack. Once the victim's session is bound to the attacker's account, the attacker can retrieve sensitive information submitted by the victim, as the victim's actions are now authenticated against the account controlled by the adversary.\nThis vulnerability affects Rodauth versions prior to 2.47.0. The lack of strict header enforcement constitutes a critical failure in the security boundary, allowing unauthorized cross-origin requests to be treated as trusted authenticated operations."
}