CVE-2026-82470

MEDIUM 5.4

Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor.

CWE	CWE-294
Vendor	jeremyevans
Product	rodauth
Published	Aug 29, 2026

Stay Ahead of the Next One

Get instant alerts for jeremyevans rodauth

Be the first to know when new medium vulnerabilities affecting jeremyevans rodauth are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

jeremyevans / rodauth

0 < 2.47.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jeremyevans/rodauth/commit/3bfd0a11bae70935b1944e71dbe787dd0c3a62ad github.com: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hhvg-6qmv-58vc github.com: https://github.com/jeremyevans/rodauth vulncheck.com: https://www.vulncheck.com/advisories/rodauth-before-2.47.0-totp-code-reuse-via-drift-window

Credits

Joshua Rogers (AISLE Research)