Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users.

Rodauth versions before 2.46.0 contain a critical authentication bypass vulnerability in the webauthn_login route. The flaw allows already logged-in users to authenticate as any other account in the system. The root cause is improper account resolution logic that falls back to session account identifiers rather than properly validating credential binding. This means an attacker with an existing session can exploit the logic flaw to complete WebAuthn authentication as an arbitrary user. The vulnerability has been patched in Rodauth version 2.46.0. A security advisory has been published on GitHub and a fix commit is available. Users are strongly advised to upgrade immediately to mitigate the risk of account takeover.