Vulnerability details
CVE-2026-77337
cakephp authentication
CakePHP: Potential Authentication bypass with CookieAuthenticator
CVSS 4.0
9.1Critical
Official description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.1Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| cakephp | authentication | < 2.11.2 | CVEProject cvelistV5 (CNA) |
| cakephp | authentication | >= 3.0.0, < 3.3.7 | CVEProject cvelistV5 (CNA) |
| cakephp | authentication | >= 4.0.0, < 4.2.1 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37 x_refsource_CONFIRM
- https://github.com/cakephp/authentication/pull/806 x_refsource_MISC
- https://github.com/cakephp/authentication/pull/807 x_refsource_MISC
- https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-25
- Last updated
- 2026-08-25
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.69%
Probability of exploitation in 30 days
53.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-290Authentication Bypass by Spoofing
- CWE-770Allocation of Resources Without Limits or Throttling