CVE-2026-82470 Rodauth before 2.47.0 TOTP Code Reuse via Drift Window
Attackers can replay observed TOTP codes within the drift window to bypass two-factor authentication in Rodauth applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82470?
CVE-2026-82470 is a medium-severity authentication bypass vulnerability in jeremyevans rodauth, published on 29 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.
Weakness: CWE-294
Which versions are affected by CVE-2026-82470?
How do I fix CVE-2026-82470?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-82470 being exploited?
There is no known exploitation of CVE-2026-82470 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-82470, GHSA-frwg-xgr9-44pg, GHSA-hhvg-6qmv-58vc, UBUNTU-CVE-2026-82470.