CVE-2026-55590
Full vulnerability record from the local CVENow database.
Description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-09 19:17:06.670000
Last modified
2026-10-25 17:10:00.197000
View original CVE JSON
{
"id": "CVE-2026-55590",
"sourceIdentifier": "[email protected]",
"published": "2026-07-09T19:17:06.670",
"lastModified": "2026-10-25T17:10:00.197",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1."
},
{
"lang": "es",
"value": "CakePHP Authentication es un plugin de autenticación para CakePHP que también puede ser usado en aplicaciones basadas en PSR-7. Antes de las versiones 2.11.1, 3.3.6 y 4.1.1, el método getLoginRedirect() contiene una debilidad a las omisiones de barra invertida que permite objetivos de redirección con nombres de host controlados por el atacante a través del parámetro de cadena de consulta de redirección. Este problema está solucionado en las versiones 2.11.1, 3.3.6 y 4.1.1."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "cakephp",
"product": "authentication",
"versions": [
{
"version": "< 2.11.1",
"status": "affected"
},
{
"version": ">= 3.0.0, < 3.3.6",
"status": "affected"
},
{
"version": ">= 4.0.0, < 4.1.1",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-09T19:18:05.336526Z",
"id": "CVE-2026-55590",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-601"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.11.1",
"matchCriteriaId": "5BDBBCF8-482A-4CAA-99FD-D93101A4CCB9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.0",
"versionEndExcluding": "3.3.6",
"matchCriteriaId": "9F9C700C-6D83-491C-BE19-6889E5B1AAA0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "4.1.1",
"matchCriteriaId": "6CE143EA-DCAE-4CEA-8846-C4420A7DCE39"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/cakephp/authentication/pull/795",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://github.com/cakephp/authentication/pull/796",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://github.com/cakephp/authentication/pull/799",
"source": "[email protected]",
"tags": [
"Issue Tracking",
"Patch"
]
},
{
"url": "https://github.com/cakephp/authentication/releases/tag/2.11.1",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/cakephp/authentication/releases/tag/3.3.6",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/cakephp/authentication/releases/tag/4.1.1",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}