Rodauth for Ruby exposes a logic flaw in the webauthn_login route that lets a logged‑in user impersonate another account. The bypass occurs because account resolution falls back to session identifiers rather than verifying the WebAuthn credential binding, allowing the attacker to complete authentication as an arbitrary user. As a result, the attacker can read, modify, or delete any data belonging to the impersonated account, effectively granting full account takeover.

The flaw affects the Rodauth authentication library maintained by jeremyevans. All released versions earlier than 2.46.0 are vulnerable, while 2.46.0 and later include the fix that correctly validates credential binding. Systems that rely on Rodauth for user authentication and that have not applied the patch remain at risk.

The CVSS score of 9.4 places this vulnerability in the critical range, and it is not listed in the CISA KEV catalog. Even though the EPSS score is unavailable, the high base severity indicates a serious risk. Exploitation requires an authenticated session to the webauthn_login endpoint; an attacker with a valid session can request another account’s credentials and succeed, effectively bypassing the authentication mechanism and moving laterally within the application.