PT-2026-50603 · Packagist · Cakephp/Authentication

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-55590

OSV

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Impact

The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.

Patches

3.3.6 and 4.1.1 contain a fix for this issue.

Workarounds

If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-55590

GHSA-HHPQ-7WG4-36JM

Affected Products

Cakephp/Authentication

References · 3

• https://osv.dev/vulnerability/GHSA-hhpq-7wg4-36jm · Vendor Advisory
• https://github.com/cakephp/authentication · Note
• https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm · Note