En bref
- CVE-2026-55590 est une vulnérabilité MOYENNE (CVSS 6.1) touchant cakephp/authentication, cakephp (cakephp).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.49%, plus élevée que 42.2% des vulnérabilités.
- Correctif : mettre à jour vers 3.3.6, 4.1.1, 2.11.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| cakephp/authentication Packagist | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1
| 3.3.64.1.12.11.1
|
| cakephp | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1
| 3.3.64.1.12.11.1
|
Description
Impact
The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches
2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds
If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
NVD description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free