CVE-2026-82467

EUVD-2026-68124
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.7 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
ruby-rodauth
forky
vulnerable
sid
vulnerable
Common Weakness Enumeration
References
https://github.com/jeremyevans/rodauth
https://github.com/jeremyevans/rodauth/commit/295044a92e358479afdf84f905dd5efe89c39aea
https://github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43m
https://www.vulncheck.com/advisories/rodauth-before-2.47.0-open-redirect-via-return-to-path