Rodauth prior to version 2.47.0 contains a CSRF protection bypass that lets attackers craft cross‑origin form posts whose Content‑Type headers include application/json substrings. This bypass skips the CSRF token validation and forces victims to authenticate to attacker‑controlled accounts, resulting in unauthorized access. The weakness is classified as a CSRF flaw (CWE‑352).

The issue affects all users of the Rodauth authentication library at versions older than 2.47.0. Any deployment that integrates these older versions and accepts form‑based requests with JSON content‑type handling is potentially impacted. The vulnerability is inherent in the library’s request validation logic regardless of the surrounding application code.

Based on the description, it is inferred that the attack vector is a cross‑origin POST request with a crafted Content‑Type header containing application/json substrings. The CVSS score of 4.9 indicates medium severity, and no EPSS exploitation data is currently available. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely abused. Attackers only need to send a crafted cross‑origin POST request; no privileged access to the server is required. The primary risk is potential illicit account takeover by bypassing standard CSRF defenses.