Six new rodauth advisories

.github/workflows/ruby.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: 3.8
+          python-version: 3.12
       - name: Install yamllint
         run: |
           python -m pip install --upgrade pip

gems/rodauth/CVE-2026-82466.yml

@@ -0,0 +1,33 @@
+---
+gem: rodauth
+cve: 2026-82466
+ghsa: 3pvr-v35r-4r75
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-82466
+title: Account takeover in webauthn_login feature
+date: 2026-08-18
+description: |
+  ## Impact
+
+  If the webauth_login feature is not enabled (the default), there
+  is no impact.
+
+  If the webauthn_login feature is enabled and the already_logged_in
+  configuration method is not used to halt or redirect, then any user
+  can login as any other user, by accessing the webauthn login page
+  while already logged in.
+cvss_v3: 8.7
+cvss_v4: 9.4
+patched_versions:
+  - ">= 2.46.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-82466
+    - https://rubygems.org/gems/rodauth/versions/2.46.0
+    - https://github.com/jeremyevans/rodauth/discussions/513
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_46_0_txt.html
+    - https://github.com/jeremyevans/rodauth/commit/35d74a9f07b2005a8ea75fc11a6539c04f3c2840
+    - https://www.vulncheck.com/advisories/rodauth-before-2.46.0-authentication-bypass-via-webauthn-login
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-3pvr-v35r-4r75
+    - https://github.com/advisories/GHSA-qw88-v783-w782
+notes: |
+  - cvss_v4 from nvd.nist.gov and GHSA URLs.

gems/rodauth/CVE-2026-82470.yml

@@ -0,0 +1,37 @@
+---
+gem: rodauth
+cve: 2026-82470
+ghsa: hhvg-6qmv-58vc
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-82470
+title: Time-based one-time password reuse vulnerability
+date: 2026-08-27
+description: |
+  If you are not using the otp feature, or you are using it but
+  setting otp_drift nil or otp_drift 0 in your Rodauth configuration,
+  there is no impact.
+
+  If you are using the otp feature with otp_drift enabled (the default
+  is 30 if the otp feature is enabled), and an attacker gets access
+  to a valid TOTP code that was already used, they can replay the
+  code during the drift window and have it be accepted as valid.
+  The drift window is 30 seconds by default, and Rodauth does not
+  allow reuse of the code within 30 seconds by default, so assuming
+  a roughly accurate clock, an attacker would have 0-30 seconds to
+  replay the valid code starting 30 seconds after it was originally
+  accepted as valid.
+cvss_v3: 5.4
+cvss_v4: 5.1
+patched_versions:
+  - ">= 2.47.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-82470
+    - https://rubygems.org/gems/rodauth/versions/2.47.0
+    - https://github.com/jeremyevans/rodauth/discussions/514
+    - https://github.com/jeremyevans/rodauth/compare/2.46.0...2.47.0
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hhvg-6qmv-58vc
+notes: |
+  - cvss_v4 from nvd.nist.gov and GHSA URL.
+  - cvss_v3 from nvd.nist.gov URL.
+  - date from GHSA URL.
+  - Unreviewed GHSA advisory

gems/rodauth/GHSA-26qw-xq5q-hv9w.yml

@@ -0,0 +1,30 @@
+---
+gem: rodauth
+ghsa: 26qw-xq5q-hv9w
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-26qw-xq5q-hv9w
+title: otp feature allows replay of OTP code for
+   a later time step accepted due to drift
+date: 2026-11-02
+description: |
+  The fix for GHSA-hhvg-6qmv-58vc does not cover OTP codes for a later
+  time step accepted due to otp_drift. Such a code can be reused
+  once the 30 second check in otp_update_last_use passes.
+
+  ## Impact
+
+  Replay of an already used OTP code (CWE-294) with the default otp_drift.
+  Exploiting it requires the password and a used code for a later time
+  step than the server's (from an authenticator whose clock was ahead),
+  replayed starting 30 seconds after its use (for 30 to 60 seconds).
+  Setting otp_drift nil avoids it.
+cvss_v4: 2.1
+patched_versions:
+  - ">= 2.50.0"
+related:
+  url:
+    - https://rubygems.org/gems/rodauth/versions/2.50.0
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_50_0_txt.html
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-26qw-xq5q-hv9w
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v4 from GHSA URL.

gems/rodauth/GHSA-h9m4-vm9w-h43m.yml

@@ -0,0 +1,45 @@
+---
+gem: rodauth
+cve: 2026-82467
+ghsa: h9m4-vm9w-h43m
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43m
+title: Return to path support allows redirects to remote
+   protocol-relative URLs
+date: 2026-08-24
+description: |
+  ## Impact
+
+  If you are not using the confirm_password feature and you are not
+  using the login_return_to_requested_location? or
+  two_factor_auth_return_to_requested_location? configuration methods
+  (the default), there is no impact.
+
+  If you are using the confirm_password feature or you are using the
+  login_return_to_requested_location? or
+  two_factor_auth_return_to_requested_location? configuration methods,
+  an attacker who can convince a user to access a path of the attacker's
+  choosing on the application using Rodauth can get Rodauth to redirect
+  to an attacker-chosen protocol-relative URL after completing the
+  action (such as logging in, performing two factor authentication,
+  or confirming their password). Whether this protocol-relative URL
+  will be redirected to depends on factors such as the user's browser.
+
+  This does not allow the attacker any access to the application, but
+  it can result in difficult to detect phishing attempts, where the
+  user ends up on an attacker controlled website after going through
+  a legitimate authentication flow in the application using Rodauth.
+cvss_v3: 4.7
+cvss_v4: 4.9
+patched_versions:
+  - ">= 2.47.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-82467
+    - https://rubygems.org/gems/rodauth/versions/2.47.0
+    - https://github.com/jeremyevans/rodauth/discussions/514
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_47_0_txt.html
+    - https://github.com/advisories/GHSA-mg2m-xp22-59vc
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43m
+notes: |
+  - cvss_v4 from nvd.nist.gov and GHSA URLs.
+  - cvss_v3 from nvd.nist.gov URL.

gems/rodauth/GHSA-hh2f-xw94-5p79.yml

@@ -0,0 +1,46 @@
+---
+gem: rodauth
+cve: 2026-82468
+ghsa: hh2f-xw94-5p79
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hh2f-xw94-5p79
+title: CSRF bypass using content-type parameter
+date: 2026-08-24
+description: |
+  ## Impact
+
+  If you are not using the json feature (the default) or you are using
+  the json_request_content_type_regexp configuration method with an
+  appropriate anchor (e.g. \A), or use are using the jwt feature with
+  default use_jwt? setting, there is no impact.
+
+  If you are using the json feature, are not setting a
+  json_request_content_type_regexp to use an appropriate anchor, and
+  are not using the jwt feature (or are using it but using also use_jwt?
+  to allow non-JWT JSON requests), then Rodauth could be vulnerable
+  to requests that bypass CSRF protection and CORS preflighting.
+
+  To be vulnerable to this affecting an authenticated session, this
+  requires that the session cookie does not enforce SameSite restrictions.
+  With the recommended sessions implementation (Roda session plugin)
+  and most modern session implementations, SameSite=Lax is used by
+  default, so the attacker-controlled site must be same-site-cross-origin,
+  significantly limiting the attack radius. However, this vulnerability
+  can be used from other locations to force a user login into an
+  attacker-controlled account (if the already_logged_in configuration
+  method is set to halt or redirect, this can only be done for
+  unauthenticated sessions).
+cvss_v3: 4.7
+cvss_v4: 4.9
+patched_versions:
+  - ">= 2.47.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-82468
+    - https://rubygems.org/gems/rodauth/versions/2.47.0
+    - https://github.com/jeremyevans/rodauth/discussions/514
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_47_0_txt.html
+    - https://github.com/advisories/GHSA-8928-x2p4-43mr
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hh2f-xw94-5p79
+notes: |
+  - cvss_v4 from nvd.nist.gov and GHSA URLs.
+  - cvss_v3 from nvd.nist.gov URL.

gems/rodauth/GHSA-w4fg-qf56-62m2.yml

@@ -0,0 +1,40 @@
+---
+gem: rodauth
+cve: 2026-82469
+ghsa: w4fg-qf56-62m2
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-w4fg-qf56-62m2
+title: jwt_refresh route doesn't require refresh token to
+  create new access token
+date: 2026-08-27
+description: |
+  ## Impact
+
+  If you are not using the jwt_refresh feature, there is no impact.
+
+  If you are using the jwt_refresh feature, and are setting
+  allow_refresh_with_expired_jwt_access_token? true in your Rodauth
+  configuration, and an attacker gets access to a expired access token,
+  they can use that expired access token to create valid access tokens
+  without access to a valid access token or valid refresh token.
+
+  Note that without allow_refresh_with_expired_jwt_access_token? true
+  being set, if the attacker gets access to a valid access token, they
+  can use that valid access token to create additional valid access
+  tokens without access to a valid refresh token. They would allow
+  an attacker to convert temporary access to an account into permanent
+  access, until there was a token clearing event for the account.
+cvss_v3: 5.4
+cvss_v4: 5.1
+patched_versions:
+  - ">= 2.47.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-82469
+    - https://rubygems.org/gems/rodauth/versions/2.47.0
+    - https://github.com/jeremyevans/rodauth/discussions/514
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_47_0_txt.html
+    - https://github.com/advisories/GHSA-mhhp-hxcr-939w
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-w4fg-qf56-62m2
+notes: |
+  - cvss_v4 from nvd.nist.gov and GHSA URLs.
+  - cvss_v3 from nvd.nist.gov URL.