Quick answers
- Is CVE-2026-82470 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82470 being exploited in the wild.
- How severe is CVE-2026-82470?
- Medium severity, with a CVSS score of 5.4, published 29 August 2026.
- Which products and versions are affected?
- Jeremy Evans Rodauth before 2.47.0.
- Is there a fix for CVE-2026-82470?
- A patch was published on 2026-08-29: Fixed in version 2.47.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82470 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82470?
- Check whether you run Jeremy Evans Rodauth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a time-based one-time password (TOTP) reuse flaw in Rodauth's OTP feature. The root cause is that the framework failed to track the timestamp of the last accepted TOTP code, allowing replay attacks during the OTP drift window. An attacker with network access who observes a valid TOTP code can resubmit it within the drift period to bypass second-factor authentication. The fix, implemented in version 2.47.0, uses the ROTP library's `verify` method with an `at` argument to track and prevent reuse by comparing against the last-used timestamp. This requires a reasonably recent version of the ROTP dependency.
Affected products
- Jeremy Evans Rodauth before 2.47.0
Timeline
- 2026-08-29: disclosed
- 2026-08-29: patched: Fixed in version 2.47.0