# CVE-2026-82470: Rodauth TOTP code reuse vulnerability in OTP feature

Source: https://junglewise.ai/threats/cve-2026-82470-rodauth-totp-code-reuse-vulnerability-in-otp-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82470 · Severity: medium · CVSS 5.4 · Published 2026-08-29

Rodauth is a popular Ruby authentication framework that supports time-based one-time passwords (TOTP) as a second authentication factor. This vulnerability allows attackers who capture a valid TOTP code to replay it during a time-window period to bypass the second factor protection, potentially gaining unauthorized access to user accounts.

Technologies: [Jeremy Evans Rodauth](https://junglewise.ai/threats/technologies/rodauth). Vendors: [Jeremy Evans](https://junglewise.ai/threats/vendors/jeremy-evans).

## Quick answers

**Is CVE-2026-82470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82470 being exploited in the wild.

**How severe is CVE-2026-82470?** Medium severity, with a CVSS score of 5.4, published 29 August 2026.

**Which products and versions are affected?** Jeremy Evans Rodauth before 2.47.0.

**Is there a fix for CVE-2026-82470?** A patch was published on 2026-08-29: Fixed in version 2.47.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82470 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82470?** Check whether you run Jeremy Evans Rodauth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a time-based one-time password (TOTP) reuse flaw in Rodauth's OTP feature. The root cause is that the framework failed to track the timestamp of the last accepted TOTP code, allowing replay attacks during the OTP drift window. An attacker with network access who observes a valid TOTP code can resubmit it within the drift period to bypass second-factor authentication. The fix, implemented in version 2.47.0, uses the ROTP library's `verify` method with an `at` argument to track and prevent reuse by comparing against the last-used timestamp. This requires a reasonably recent version of the ROTP dependency.

## Affected products

- Jeremy Evans Rodauth before 2.47.0

## Timeline

- 2026-08-29: disclosed
- 2026-08-29: patched: Fixed in version 2.47.0

## References

- [https://github.com/jeremyevans/rodauth](https://github.com/jeremyevans/rodauth)
- [https://github.com/jeremyevans/rodauth/commit/3bfd0a11bae70935b1944e71dbe787dd0c3a62ad](https://github.com/jeremyevans/rodauth/commit/3bfd0a11bae70935b1944e71dbe787dd0c3a62ad)

## Related threats

- [Rodauth JWT refresh authentication bypass in non-POST requests](https://junglewise.ai/threats/cve-2026-82469-rodauth-jwt-refresh-authentication-bypass-in-non-post-requests)
- [Rodauth CSRF protection bypass in JSON request validation](https://junglewise.ai/threats/cve-2026-82468-rodauth-csrf-protection-bypass-in-json-request-validation)
- [Rodauth authentication bypass in webauthn_login](https://junglewise.ai/threats/cve-2026-82466-rodauth-authentication-bypass-in-webauthn-login)