Is CVE-2026-82467 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82467 being exploited in the wild.

How severe is CVE-2026-82467?

Medium severity, with a CVSS score of 4.7, published 29 August 2026.

Is there a fix for CVE-2026-82467?

A patch was published on 2026-08-23: Fix released in version 2.47.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82467 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82467?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82467: Rodauth open redirect via protocol-relative return-to paths

CVE-2026-82467 · Severity: medium · CVSS 4.7 · Published 2026-08-29

Rodauth is a Ruby authentication framework used to handle user login and password confirmation. The framework failed to properly validate where users are redirected after login or password confirmation, allowing attackers to craft malicious URLs that redirect authenticated users to phishing sites while appearing to come from the legitimate login page.

Quick answers

Is CVE-2026-82467 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82467 being exploited in the wild.
How severe is CVE-2026-82467?: Medium severity, with a CVSS score of 4.7, published 29 August 2026.
Which products and versions are affected?: Rodauth Rodauth before 2.47.0.
Is there a fix for CVE-2026-82467?: A patch was published on 2026-08-23: Fix released in version 2.47.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82467 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82467?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Rodauth before 2.47.0 contains an open redirect vulnerability in the confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. The vulnerability stems from inadequate validation of protocol-relative paths (starting with //), which browsers interpret as URLs that adopt the current page's protocol. Attackers can craft return-to paths with leading double slashes to redirect authenticated users to attacker-controlled domains after successful authentication. The vulnerability requires no special privileges and is network-reachable; the victim must authenticate and be redirected. A fix was released in version 2.47.0 with new configuration methods (return_to_path_max_size and valid_return_to_path?) to validate redirect targets.

Affected products

Rodauth Rodauth before 2.47.0

Timeline

2026-08-29: disclosed
2026-08-23: patched: Fix released in version 2.47.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.