Rodauth releases before 2.47.0 contain a flaw in the jwt_refresh route that permits the issuance of new JWT access tokens without requiring an accompanying refresh token. The bug allows an attacker who can present an existing, albeit temporary, access token to the refresh endpoint via non‑POST methods to obtain a fresh, valid access token. This bypass enables indefinite continuation of authenticated sessions once an initial token is acquired, undermining the integrity of the authentication system.

The vulnerability affects the Rodauth authentication library developed by Jeremiah Evans. Versions of Rodauth prior to 2.47.0 are impacted; no more granular version data is provided beyond the pre‑2.47.0 baseline.

The CVSS score of 5.1 indicates a moderate severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploitation yet. The attack vector requires that an attacker can acquire a temporary access token for the target account; with that token in hand, the exploit is straightforward because the jwt_refresh endpoint lacks proper method and token checks. Engineers can defend against exploitation by ensuring only POST requests are accepted and by validating the presence of a legitimate refresh token before issuing new JWTs.