Account takeover in webauthn_login feature
Published: August 18, 2026
SECURITY IDENTIFIERS
- CVE: CVE-2026-82466 (NVD)
- GHSA: GHSA-3pvr-v35r-4r75
GEM
SEVERITY
CVSS v3.x: 8.7 (High)
PATCHED VERSIONS
>= 2.46.0
DESCRIPTION
Impact
If the webauth_login feature is not enabled (the default), there is no impact.
If the webauthn_login feature is enabled and the already_logged_in configuration method is not used to halt or redirect, then any user can login as any other user, by accessing the webauthn login page while already logged in.
RELATED
- https://nvd.nist.gov/vuln/detail/CVE-2026-82466
- https://rubygems.org/gems/rodauth/versions/2.46.0
- https://github.com/jeremyevans/rodauth/discussions/513
- https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_46_0_txt.html
- https://github.com/jeremyevans/rodauth/commit/35d74a9f07b2005a8ea75fc11a6539c04f3c2840
- https://www.vulncheck.com/advisories/rodauth-before-2.46.0-authentication-bypass-via-webauthn-login
- https://github.com/jeremyevans/rodauth/security/advisories/GHSA-3pvr-v35r-4r75
- https://github.com/advisories/GHSA-qw88-v783-w782