Executive brief
Rodauth is a Ruby authentication framework used to secure web applications. This vulnerability allows attackers to bypass the cross-site request forgery (CSRF) protection by crafting malicious web forms that trick users into performing unintended actions on their authenticated accounts, including forcing victims to authenticate to attacker-controlled accounts.
Technical details
The vulnerability exists in Rodauth's JSON feature, where the content-type validation regex for identifying JSON requests is incorrectly anchored with a word boundary (\b) instead of the string start anchor (\A). This allows attackers to craft cross-origin form posts with content-type headers like "form-data; type=application/json" where the application/json substring appears as a parameter rather than the actual content type. Since the regex matches the embedded application/json substring, Rodauth incorrectly treats the request as a safe JSON request (which normally require CORS and are exempt from CSRF checks) and skips CSRF token validation. An attacker can exploit this by crafting a form on an attacker-controlled site that, when visited by a logged-in user, performs unauthorized actions without a valid CSRF token.
Affected products
- Jeremy Evans Rodauth before 2.47.0
Timeline
- 2026-08-29: disclosed
- 2026-08-29: patched: Fix applied in commit 3e0d7ab by anchoring json_request_content_type_regexp with \A instead of \b