CVE-2026-77337

CakePHP Authentication (a plugin for CakePHP and PSR-7 based applications) is affected by a critical vulnerability (CVSS 4.0: 9.1 ) in the CookieAuthenticator component. When legacy tokens are used, they are unencrypted and forgeable , enabling authentication bypass and potential CPU or memory ex...

PT-2026-81053

Name of the Vulnerable Software and Affected Versions CakePHP Authentication versions prior to 2.11.2 CakePHP Authentication versions 3.0.0 through 3.3.6 CakePHP Authentication versions 4.0.0 through 4.2.0 Description An authentication bypass and potential CPU or memory exhaustion can occur when...

CVE-2026-55590

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the...

CVE-2026-55590

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in the getLoginRedirect function. An attacker can redirect users to an attacker-controlled hostname by exploiting a backslash bypass in the redirect target. Remediation Upgrade cakephp/authentication to version 3.3.6, 4.1....