CVE-2026-82469 | BDVDB-2026-366285 Detail

Description#

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-29Record published in the CVE List.
2. Version 22026-09-01Most recent update recorded in the CVE List.