Search
Find a vulnerability
Search criteria
4 vulnerabilities found for authentication by cakephp
CVE-2026-77337 (GCVE-0-2026-77337)
Vulnerability from nvd – Published: 2026-08-24 21:30 – Updated: 2026-08-25 19:23
VLAI
EPSS
VEX
Title
CakePHP: Potential Authentication bypass with CookieAuthenticator
Summary
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 18:32 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/authentication/securit… | x_refsource_CONFIRM |
| https://github.com/cakephp/authentication/pull/806 | x_refsource_MISC |
| https://github.com/cakephp/authentication/pull/807 | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cakephp | authentication |
Affected:
< 2.11.2
Affected: >= 3.0.0, < 3.3.7 Affected: >= 4.0.0, < 4.2.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T18:32:35.314141Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T19:23:34.125Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authentication",
"vendor": "cakephp",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.2"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.3.7"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T21:30:06.817Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37"
},
{
"name": "https://github.com/cakephp/authentication/pull/806",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/806"
},
{
"name": "https://github.com/cakephp/authentication/pull/807",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/807"
},
{
"name": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159"
}
],
"source": {
"advisory": "GHSA-h7xh-9h2x-2m37",
"discovery": "UNKNOWN"
},
"title": "CakePHP: Potential Authentication bypass with CookieAuthenticator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77337",
"datePublished": "2026-08-24T21:30:06.817Z",
"dateReserved": "2026-08-20T19:24:11.618Z",
"dateUpdated": "2026-08-25T19:23:34.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55590 (GCVE-0-2026-55590)
Vulnerability from nvd – Published: 2026-07-09 18:55 – Updated: 2026-07-09 19:18
VLAI
EPSS
VEX
Title
CakePHP: Open redirect weakness via backslash bypass
Summary
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 19:18 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/authentication/securit… | x_refsource_CONFIRM |
| https://github.com/cakephp/authentication/pull/795 | x_refsource_MISC |
| https://github.com/cakephp/authentication/pull/796 | x_refsource_MISC |
| https://github.com/cakephp/authentication/pull/799 | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
| https://github.com/cakephp/authentication/release… | x_refsource_MISC |
| https://github.com/cakephp/authentication/release… | x_refsource_MISC |
| https://github.com/cakephp/authentication/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cakephp | authentication |
Affected:
< 2.11.1
Affected: >= 3.0.0, < 3.3.6 Affected: >= 4.0.0, < 4.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T19:18:05.336526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T19:18:12.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authentication",
"vendor": "cakephp",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.1"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.3.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T18:55:30.241Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm"
},
{
"name": "https://github.com/cakephp/authentication/pull/795",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/795"
},
{
"name": "https://github.com/cakephp/authentication/pull/796",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/796"
},
{
"name": "https://github.com/cakephp/authentication/pull/799",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/799"
},
{
"name": "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
},
{
"name": "https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d"
},
{
"name": "https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c"
},
{
"name": "https://github.com/cakephp/authentication/releases/tag/2.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/releases/tag/2.11.1"
},
{
"name": "https://github.com/cakephp/authentication/releases/tag/3.3.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/releases/tag/3.3.6"
},
{
"name": "https://github.com/cakephp/authentication/releases/tag/4.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/releases/tag/4.1.1"
}
],
"source": {
"advisory": "GHSA-hhpq-7wg4-36jm",
"discovery": "UNKNOWN"
},
"title": "CakePHP: Open redirect weakness via backslash bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55590",
"datePublished": "2026-07-09T18:55:30.241Z",
"dateReserved": "2026-06-16T23:18:03.170Z",
"dateUpdated": "2026-07-09T19:18:12.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77337 (GCVE-0-2026-77337)
Vulnerability from cvelistv5 – Published: 2026-08-24 21:30 – Updated: 2026-08-25 19:23
VLAI
EPSS
VEX
Title
CakePHP: Potential Authentication bypass with CookieAuthenticator
Summary
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 18:32 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/authentication/securit… | x_refsource_CONFIRM |
| https://github.com/cakephp/authentication/pull/806 | x_refsource_MISC |
| https://github.com/cakephp/authentication/pull/807 | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cakephp | authentication |
Affected:
< 2.11.2
Affected: >= 3.0.0, < 3.3.7 Affected: >= 4.0.0, < 4.2.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T18:32:35.314141Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T19:23:34.125Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authentication",
"vendor": "cakephp",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.2"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.3.7"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T21:30:06.817Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37"
},
{
"name": "https://github.com/cakephp/authentication/pull/806",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/806"
},
{
"name": "https://github.com/cakephp/authentication/pull/807",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/807"
},
{
"name": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159"
}
],
"source": {
"advisory": "GHSA-h7xh-9h2x-2m37",
"discovery": "UNKNOWN"
},
"title": "CakePHP: Potential Authentication bypass with CookieAuthenticator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77337",
"datePublished": "2026-08-24T21:30:06.817Z",
"dateReserved": "2026-08-20T19:24:11.618Z",
"dateUpdated": "2026-08-25T19:23:34.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55590 (GCVE-0-2026-55590)
Vulnerability from cvelistv5 – Published: 2026-07-09 18:55 – Updated: 2026-07-09 19:18
VLAI
EPSS
VEX
Title
CakePHP: Open redirect weakness via backslash bypass
Summary
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-09 19:18 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/cakephp/authentication/securit… | x_refsource_CONFIRM |
| https://github.com/cakephp/authentication/pull/795 | x_refsource_MISC |
| https://github.com/cakephp/authentication/pull/796 | x_refsource_MISC |
| https://github.com/cakephp/authentication/pull/799 | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
| https://github.com/cakephp/authentication/commit/… | x_refsource_MISC |
| https://github.com/cakephp/authentication/release… | x_refsource_MISC |
| https://github.com/cakephp/authentication/release… | x_refsource_MISC |
| https://github.com/cakephp/authentication/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cakephp | authentication |
Affected:
< 2.11.1
Affected: >= 3.0.0, < 3.3.6 Affected: >= 4.0.0, < 4.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T19:18:05.336526Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T19:18:12.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authentication",
"vendor": "cakephp",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.1"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.3.6"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T18:55:30.241Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm"
},
{
"name": "https://github.com/cakephp/authentication/pull/795",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/795"
},
{
"name": "https://github.com/cakephp/authentication/pull/796",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/796"
},
{
"name": "https://github.com/cakephp/authentication/pull/799",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/pull/799"
},
{
"name": "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273"
},
{
"name": "https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d"
},
{
"name": "https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c"
},
{
"name": "https://github.com/cakephp/authentication/releases/tag/2.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/releases/tag/2.11.1"
},
{
"name": "https://github.com/cakephp/authentication/releases/tag/3.3.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/releases/tag/3.3.6"
},
{
"name": "https://github.com/cakephp/authentication/releases/tag/4.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cakephp/authentication/releases/tag/4.1.1"
}
],
"source": {
"advisory": "GHSA-hhpq-7wg4-36jm",
"discovery": "UNKNOWN"
},
"title": "CakePHP: Open redirect weakness via backslash bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55590",
"datePublished": "2026-07-09T18:55:30.241Z",
"dateReserved": "2026-06-16T23:18:03.170Z",
"dateUpdated": "2026-07-09T19:18:12.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}