In short
- CVE-2026-55590 is a MEDIUM (CVSS 6.1) vulnerability affecting cakephp/authentication, cakephp (cakephp).
- Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.2% of all vulnerabilities.
- Fix: update to 3.3.6, 4.1.1, 2.11.1 or later.
| Package | Affected versions | Patched versions |
|---|
| cakephp/authentication Packagist | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1
| 3.3.64.1.12.11.1
|
| cakephp | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1
| 3.3.64.1.12.11.1
|
Description
Impact
The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches
2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds
If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
NVD description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free