p PatchFirst

CVE-2026-55590

CVE-2026-55590 · CakePHP: Open redirect weakness via backslash bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

CVSS 5.1 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • authentication

    Versions
    • < 2.11.1: Affected
    • >= 3.0.0, < 3.3.6: Affected
    • >= 4.0.0, < 4.1.1: Affected

    No fix published

  • cakephp/authentication Packagist

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.1.0
    • 3.1.1
    • 3.2.0
    • 3.2.1
    • 3.2.2
    • 3.2.3
    • 3.2.4
    • 3.2.5
    • 3.3.0
    • 3.3.1
    • 3.3.2
    • 3.3.3
    • 3.3.4
    • 3.3.5
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 3.3.6

    Update to 3.3.6

  • cakephp/authentication Packagist

    Versions
    • 4.0.0
    • 4.0.1
    • 4.1.0
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.1.1

    Update to 4.1.1

  • cakephp/authentication Packagist

    Versions
    • 1.0.0
    • 1.0.0-alpha1
    • 1.0.0-beta1
    • 1.0.0-beta2
    • 1.0.0-beta3
    • 1.0.0-beta4
    • 1.0.0-rc1
    • 1.0.0-rc2
    • 1.0.0-rc3
    • 1.0.0-rc4
    • 1.0.0-rc5
    • 1.0.0-rc6
    • 1.0.0-rc7
    • 1.0.0-rc8
    • 1.0.0-rc9
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.2.0
    • 1.2.1
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.1.0
    • 2.10.0
    • 2.10.1
    • 2.10.2
    • 2.11.0
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.5.0
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.7.0
    • 2.8.0
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: < 2.11.1

    Update to 2.11.1

Original sources

Check your server →