CVE-2026-77337
CriticalCVSS 9.1Summary
A vulnerability in CakePHP Authentication plugin (versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0) allows authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. Fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Risk Assessment
An attacker can bypass authentication and gain unauthorized access to the application, and also cause system overload, potentially leading to security breaches and service availability issues.
Recommendation
Update CakePHP Authentication to version 2.11.2, 3.3.7, or 4.2.1 (or later). Review CookieAuthenticator configuration and ensure secure tokens are used.
Original NVD description (English source)
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.