CVE-2026-77337

CriticalCVSS 9.1

Published: 24/08/2026(UTC)Updated: 09/09/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

A vulnerability in CakePHP Authentication plugin (versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0) allows authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. Fixed in versions 2.11.2, 3.3.7, and 4.2.1.

Risk Assessment

An attacker can bypass authentication and gain unauthorized access to the application, and also cause system overload, potentially leading to security breaches and service availability issues.

Recommendation

Update CakePHP Authentication to version 2.11.2, 3.3.7, or 4.2.1 (or later). Review CookieAuthenticator configuration and ensure secure tokens are used.

Other vulnerabilities in CakePHP Authentication

CVE-2026-55590Medium
A vulnerability in the CakePHP Authentication plugin allows bypassing redirect restrictions via backslash characters in the redirect parameter. An attacker can control the target hostname, enabling phishing or other social engineering attacks.

Original NVD description (English source)

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS