Quick answers
- Is CVE-2026-82468 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82468 being exploited in the wild.
- How severe is CVE-2026-82468?
- Medium severity, with a CVSS score of 4.7, published 29 August 2026.
- Which products and versions are affected?
- Jeremy Evans Rodauth before 2.47.0.
- Is there a fix for CVE-2026-82468?
- A patch was published on 2026-08-29: Fix applied in commit 3e0d7ab by anchoring json_request_content_type_regexp with \A instead of \b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82468 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82468?
- Check whether you run Jeremy Evans Rodauth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in Rodauth's JSON feature, where the content-type validation regex for identifying JSON requests is incorrectly anchored with a word boundary (\b) instead of the string start anchor (\A). This allows attackers to craft cross-origin form posts with content-type headers like "form-data; type=application/json" where the application/json substring appears as a parameter rather than the actual content type. Since the regex matches the embedded application/json substring, Rodauth incorrectly treats the request as a safe JSON request (which normally require CORS and are exempt from CSRF checks) and skips CSRF token validation. An attacker can exploit this by crafting a form on an attacker-controlled site that, when visited by a logged-in user, performs unauthorized actions without a valid CSRF token.
Affected products
- Jeremy Evans Rodauth before 2.47.0
Timeline
- 2026-08-29: disclosed
- 2026-08-29: patched: Fix applied in commit 3e0d7ab by anchoring json_request_content_type_regexp with \A instead of \b