Impact

If you are not using the json feature (the default) or you are using the json_request_content_type_regexp configuration method with an appropriate anchor (e.g. \A), or use are using the jwt feature with default use_jwt? setting, there is no impact.

If you are using the json feature, are not setting a json_request_content_type_regexp to use an appropriate anchor, and are not using the jwt feature (or are using it but using also use_jwt? to allow non-JWT JSON requests), then Rodauth could be vulnerable to requests that bypass CSRF protection and CORS preflighting.

To be vulnerable to this affecting an authenticated session, this requires that the session cookie does not enforce SameSite restrictions. With the recommended sessions implementation (Roda session plugin) and most modern session implementations, SameSite=Lax is used by default, so the attacker-controlled site must be same-site-cross-origin, significantly limiting the attack radius. However, this vulnerability can be used from other locations to force a user login into an attacker-controlled account (if the already_logged_in configuration method is set to halt or redirect, this can only be done for unauthenticated sessions).