p PatchFirst

CVE-2026-77337

CVE-2026-77337 · CakePHP: Potential Authentication bypass with CookieAuthenticator

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

CVSS 9.1 · Critical · EPSS 0.7%

Published
Updated

Stack: system

Affected products and versions

  • authentication

    Versions
    • < 2.11.2: Affected
    • >= 3.0.0, < 3.3.7: Affected
    • >= 4.0.0, < 4.2.1: Affected

    No fix published

  • cakephp Debian:11

    Versions
    • 2.10.11-2.1
    • 2.10.24-1
    • 2.10.24-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cakephp Ubuntu:16.04:LTS

    Versions
    • 2.7.2-1
    • 2.8.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cakephp Ubuntu:20.04:LTS

    Versions
    • 2.10.11-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cakephp Ubuntu:22.04:LTS

    Versions
    • 2.10.11-2.1
    • 2.10.24-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →