CVE-2026-82468

ruby-rodauth: Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request conte...

CVE-2026-82468 is fixed in ruby-rodauth on 1 platform by DEBIAN-CVE-2026-82468 (version 2.47.0-1), released September 14, 2026. It is not reported as exploited. Patch Radar priority: Routine.

Routine

CVSS

n/a

No vendor severity

Exploitation

None reported

No vendor assessment

CISA KEV

Not listed

Not in the Known Exploited Vulnerabilities catalog

EPSS

0.0018

7th percentile

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

Where it's fixed

Product	Fixed in	Fix	Released
Linux
ruby-rodauth · Debian 14	2.47.0-1	DEBIAN-CVE-2026-82468	Sep 14, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.