Medium severity4.7NVD Advisory· Published Aug 29, 2026

CVE-2026-82467

Description

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Rodauth/rodauthllm-create
Range: <2.47.0

Patches

Vulnerability mechanics

References

github.com/jeremyevans/rodauth/commit/295044a92e358479afdf84f905dd5efe89c39aeanvd
github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43mnvd
www.vulncheck.com/advisories/rodauth-before-2.47.0-open-redirect-via-return-to-pathnvd

News mentions

No linked articles in our index yet.

cvss	0.306
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000