CVE-2026-55590

MediumCVSS 6.1

Published: 09/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

44th percentile - higher than 44% of all known CVEs

Summary

A vulnerability in the CakePHP Authentication plugin allows bypassing redirect restrictions via backslash characters in the redirect parameter. An attacker can control the target hostname, enabling phishing or other social engineering attacks.

Risk Assessment

The organization is at risk of users being redirected to malicious sites, potentially leading to credential theft or malware infection.

Recommendation

Immediately update the CakePHP Authentication plugin to version 2.11.1, 3.3.6, or 4.1.1 depending on the branch in use.

Other vulnerabilities in CakePHP Authentication

CVE-2026-77337Critical
A vulnerability in CakePHP Authentication plugin (versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0) allows authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. Fixed in versions 2.11.2, 3.3.7, and 4.2.1.

Original NVD description (English source)

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS