PT-2026-50603 · Packagist · Cakephp/Authentication

Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-55590

OSV

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Impact

The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.

Patches

3.3.6 and 4.1.1 contain a fix for this issue.

Workarounds

If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-55590

GHSA-HHPQ-7WG4-36JM

Produtos afetados

Cakephp/Authentication

Referências · 3

• https://github.com/cakephp/authentication · Nota
• https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm · Nota
• https://osv.dev/vulnerability/GHSA-hhpq-7wg4-36jm · Aviso do Fabricante