CVE-2026-119416

CakePHP versions through 5.4.3 are vulnerable to an improper cookie domain validation flaw in the Http Client CookieCollection component. The root cause is unanchored suffix matching , which allows malicious servers to abuse the Set-Cookie Domain attribute. Attackers controlling a host with a suf...