MEDIUM
GHSA-hhpq-7wg4-36jm
CakePHP Authentication: Open redirect weakness via backslash bypass
Quick fix
GHSA-hhpq-7wg4-36jm — cakephp/authentication: upgrade to the fixed version with the command below.
composer require cakephp/authentication:^3.3.6Details
### Impact The `getLoginRedirect()` method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
### Patches 2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.
### Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / cakephp/authentication
Introduced in:
3.0.0 Fixed in: 3.3.6 Fix
composer require cakephp/authentication:^3.3.6 Packagist / cakephp/authentication
Introduced in:
4.0.0 Fixed in: 4.1.1 Fix
composer require cakephp/authentication:^4.1.1 Packagist / cakephp/authentication
Introduced in:
0 Fixed in: 2.11.1 Fix
composer require cakephp/authentication:^2.11.1 References
- https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-55590 [ADVISORY]
- https://github.com/cakephp/authentication/pull/795 [WEB]
- https://github.com/cakephp/authentication/pull/796 [WEB]
- https://github.com/cakephp/authentication/pull/799 [WEB]
- https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273 [WEB]
- https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d [WEB]
- https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c [WEB]
- https://github.com/cakephp/authentication [PACKAGE]
- https://github.com/cakephp/authentication/releases/tag/2.11.1 [WEB]
- https://github.com/cakephp/authentication/releases/tag/3.3.6 [WEB]
- https://github.com/cakephp/authentication/releases/tag/4.1.1 [WEB]