# CVE-2026-82468: Rodauth CSRF protection bypass in JSON request validation

Source: https://junglewise.ai/threats/cve-2026-82468-rodauth-csrf-protection-bypass-in-json-request-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82468 · Severity: medium · CVSS 4.7 · Published 2026-08-29

Rodauth is a Ruby authentication framework used to secure web applications. This vulnerability allows attackers to bypass the cross-site request forgery (CSRF) protection by crafting malicious web forms that trick users into performing unintended actions on their authenticated accounts, including forcing victims to authenticate to attacker-controlled accounts.

Technologies: [Jeremy Evans Rodauth](https://junglewise.ai/threats/technologies/rodauth). Vendors: [Jeremy Evans](https://junglewise.ai/threats/vendors/jeremy-evans).

## Quick answers

**Is CVE-2026-82468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82468 being exploited in the wild.

**How severe is CVE-2026-82468?** Medium severity, with a CVSS score of 4.7, published 29 August 2026.

**Which products and versions are affected?** Jeremy Evans Rodauth before 2.47.0.

**Is there a fix for CVE-2026-82468?** A patch was published on 2026-08-29: Fix applied in commit 3e0d7ab by anchoring json_request_content_type_regexp with \A instead of \b Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82468 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82468?** Check whether you run Jeremy Evans Rodauth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Rodauth's JSON feature, where the content-type validation regex for identifying JSON requests is incorrectly anchored with a word boundary (\b) instead of the string start anchor (\A). This allows attackers to craft cross-origin form posts with content-type headers like "form-data; type=application/json" where the application/json substring appears as a parameter rather than the actual content type. Since the regex matches the embedded application/json substring, Rodauth incorrectly treats the request as a safe JSON request (which normally require CORS and are exempt from CSRF checks) and skips CSRF token validation. An attacker can exploit this by crafting a form on an attacker-controlled site that, when visited by a logged-in user, performs unauthorized actions without a valid CSRF token.

## Affected products

- Jeremy Evans Rodauth before 2.47.0

## Timeline

- 2026-08-29: disclosed
- 2026-08-29: patched: Fix applied in commit 3e0d7ab by anchoring json_request_content_type_regexp with \A instead of \b

## References

- [https://github.com/jeremyevans/rodauth](https://github.com/jeremyevans/rodauth)
- [https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8a8258aa57a](https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8a8258aa57a)

## Related threats

- [Rodauth TOTP code reuse vulnerability in OTP feature](https://junglewise.ai/threats/cve-2026-82470-rodauth-totp-code-reuse-vulnerability-in-otp-feature)
- [Rodauth JWT refresh authentication bypass in non-POST requests](https://junglewise.ai/threats/cve-2026-82469-rodauth-jwt-refresh-authentication-bypass-in-non-post-requests)
- [Rodauth authentication bypass in webauthn_login](https://junglewise.ai/threats/cve-2026-82466-rodauth-authentication-bypass-in-webauthn-login)