Description
Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting authenticated users to attacker-controlled sites after login or password confirmation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jeremyevans rodauth
Default version status: unaffected
0 to < 2.47.0affected
References
- https://github.com/jeremyevans/rodauth/commit/295044a92e358479afdf84f905dd5efe89c39aea ↗
- https://github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43m ↗
- https://github.com/jeremyevans/rodauth ↗
- https://www.vulncheck.com/advisories/rodauth-before-2.47.0-open-redirect-via-return-to-path ↗