In breve
- CVE-2026-55590 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda cakephp/authentication, cakephp (cakephp).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.49%, superiore al 42.2% delle vulnerabilità.
- Correzione: aggiornare a 3.3.6, 4.1.1, 2.11.1 o successiva.
| Package | Affected versions | Patched versions |
|---|
| cakephp/authentication Packagist | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1
| 3.3.64.1.12.11.1
|
| cakephp | ≥ 3.0.0, < 3.3.6≥ 4.0.0, < 4.1.1< 2.11.1
| 3.3.64.1.12.11.1
|
Description
Impact
The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches
2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds
If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
NVD description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free