Hi,

The following vulnerabilities were published for ruby-rodauth.

CVE-2026-82467[0]:
| Rodauth before 2.47.0 fails to validate protocol-relative return-to
| paths in confirm_password, login_return_to_requested_location, and
| two_factor_auth_return_to_requested_location features. Attackers can
| craft paths with leading double slashes that browsers resolve as
| protocol-relative URLs, redirecting authenticated users to attacker-
| controlled sites after login or password confirmation.


CVE-2026-82468[1]:
| Rodauth before 2.47.0 contains a cross-site request forgery
| protection bypass vulnerability in the JSON request content type
| validation. Attackers can craft cross-origin form posts with content
| types containing application/json substrings to bypass CSRF token
| validation and force victims to authenticate to attacker-controlled
| accounts.


CVE-2026-82469[2]:
| Rodauth before 2.47.0 contains an authentication bypass
| vulnerability in the jwt_refresh route that issues new JWT access
| tokens without requiring a refresh token. Attackers can present an
| access token to the refresh route via non-POST methods to obtain a
| new valid access token, enabling indefinite account access with
| temporary token possession.


CVE-2026-82470[3]:
| Rodauth before 2.47.0 contains a time-based one-time password reuse
| vulnerability in the otp feature that fails to track the last
| accepted code timestamp. Attackers who observe a valid TOTP code can
| replay it during the drift window to bypass the second
| authentication factor.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-82467
https://www.cve.org/CVERecord?id=CVE-2026-82467
[1] https://security-tracker.debian.org/tracker/CVE-2026-82468
https://www.cve.org/CVERecord?id=CVE-2026-82468
[2] https://security-tracker.debian.org/tracker/CVE-2026-82469
https://www.cve.org/CVERecord?id=CVE-2026-82469
[3] https://security-tracker.debian.org/tracker/CVE-2026-82470
https://www.cve.org/CVERecord?id=CVE-2026-82470

Regards,
Salvatore