A high-severity authentication bypass vulnerability in Rodauth allows authenticated users to hijack other accounts, posing a severe risk to application integrity and user data privacy.

This flaw involves improper authentication logic within the WebAuthn login route. The application fails to properly validate credential bindings, causing it to incorrectly fall back to session account identifiers and permitting an already logged-in user to authenticate as an arbitrary account.

The ability for an attacker to bypass authentication mechanisms and impersonate any user on the platform constitutes a critical failure of the security model. This could lead to unauthorized access to sensitive user data, administrative takeover of accounts, and total compromise of application confidentiality and integrity. Given the CVSS score of 8.7, this vulnerability represents a significant threat to business operations and regulatory compliance.

Immediate Action: Update the Rodauth library to version 2.46.0 or later immediately to incorporate the necessary credential binding validation logic.

Proactive Monitoring: Review application access logs for suspicious authentication patterns, specifically looking for users switching account contexts or unauthorized WebAuthn login events.

Compensating Controls: While no direct WAF rule can fix the underlying logic flaw, ensure that strict session management and secondary authentication controls are enforced for high-privilege actions until the patch is applied.

Public Exploit Available: No

This vulnerability presents a high risk to any application utilizing the Rodauth WebAuthn login feature. Organizations must prioritize the upgrade to version 2.46.0 to eliminate the improper authentication logic. Failure to patch this flaw leaves user accounts vulnerable to total takeover by malicious actors.