CakePHP: Potential Authentication bypass with CookieAuthenticator
Priority MEDIUM 40CWE-290Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass, Denial of service
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290 and CWE-770.
Summary
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00698 53rd percentileScored 2026-11-07
Fix Fixed authentication (cakephp): 2.11.2, 3.3.7, 4.2.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cakephp | authentication | before 2.11.2; 3.0.0 to before 3.3.7; 4.0.0 to before 4.2.1 | 2.11.2, 3.3.7, 4.2.1 | Patch available | CNA |
- authentication Vendorcakephp Affected before 2.11.2; 3.0.0 to before 3.3.7; 4.0.0 to before 4.2.1 Fixed in 2.11.2, 3.3.7, 4.2.1 Patch available CNA
Remediation
- Fix · CNA authentication (cakephp) Fixed in 2.11.2, 3.3.7, 4.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77337
References
More cakephp vulnerabilities
- TI-2010-04068 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… CVSS 2.0HIGH 7.5
- TI-2026-82995 Cookie leakage in CakePHP HTTP client cookie domain matching CVSS 4.0MEDIUM 6.3
- TI-2026-19037 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVSS 3.1MEDIUM 5.4
- TI-2023-08901 Database Query::offset() and limit() vulnerable to SQL injection in cakephp CVSS 3.1CRITICAL 9.8
- TI-2026-54106 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CVSS 4.0CRITICAL 9.2
- TI-2026-55232 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CVSS 4.0CRITICAL 9.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences