Description

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-29T17:17:59.350Z",
  "pubdate": "2026-08-29T17:17:59.350Z",
  "executiveSummary": "Rodauth versions prior to 2.47.0 contain a critical authentication bypass vulnerability within the jwt_refresh route. The vulnerability allows an unauthorized actor to request and receive a valid JWT access token without the requisite refresh token. This flaw arises from improper handling of HTTP methods and validation logic within the jwt_refresh functionality. By utilizing non-POST HTTP methods, an attacker can coerce the application into issuing a new token based solely on an existing access token. The impact is significant, as it enables indefinite session persistence and account takeover, effectively circumventing the security controls intended to expire short-lived access tokens. Successful exploitation does not require administrative privileges, merely temporary access to a valid (even potentially expired) access token. This represents a severe risk to session integrity and authentication state management for applications utilizing Rodauth's JWT feature set.",
  "technicalDetails": "The vulnerability resides within the Rodauth jwt_refresh route, which is responsible for issuing new JWT access tokens. The root cause is a flaw in the route handler's validation logic, which fails to strictly enforce the submission of a valid refresh token when the request is processed via non-POST methods.\nThe attack flow begins when an attacker acquires a valid JWT access token. Under normal operation, the jwt_refresh route should validate a refresh token provided in the request body to authorize the issuance of a new access token. However, in vulnerable versions of Rodauth, the logic fails to verify the presence or validity of a refresh token when the request is sent using methods other than POST, such as GET or PUT.\nExploitation involves the attacker presenting their existing access token to the jwt_refresh endpoint. By shifting the request method to a non-POST protocol, the server bypasses the requirement for the refresh token validation block. The application incorrectly treats the existing access token as sufficient proof of authorization to trigger the token generation function. Consequently, the backend logic executes the issuance flow and returns a freshly signed access token to the attacker.\nThis behavior exposes a significant logical flaw in state verification. The vulnerable component fails to implement a consistent authentication guard across different HTTP methods, leading to an insecure state transition. An attacker can repeatedly trigger this endpoint, effectively resetting the expiration timer of their access and maintaining persistent, unauthorized access to the target account indefinitely.\nThe vulnerability affects Rodauth versions before 2.47.0. It requires the attacker to have already obtained at least one valid JWT access token. Once obtained, no further privileges are required to exploit the flaw. As the jwt_refresh route is typically exposed to the network to facilitate authentication, the risk of remote exploitation is high."
}