CVE-2026-55590 Details
Description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
A vulnerability allowing open redirects has been identified in the CakePHP Authentication plugin, affecting versions prior to 2.11.1, 3.3.6, and 4.1.1. The issue arises in the getLoginRedirect() method, where backslash bypasses can be exploited to inject attacker-controlled hostnames into redirect targets via the redirect query string parameter.
Users can upgrade to CakePHP Authentication versions 2.11.1, 3.3.6, or 4.1.1 to address this vulnerability. If an upgrade is not possible, consider adding validation to the redirect query string parameter to prevent this type of bypass.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cakephp cakephp | < 2.11.1 >= 3.0.0, < 3.3.6 >= 4.0.0, < 4.1.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |