CVE-2026-55590 CakePHP: Open redirect weakness via backslash bypass
Attackers can bypass redirect validation to send users to malicious sites via the login redirect parameter in the CakePHP authentication plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55590?
CVE-2026-55590 is a medium-severity vulnerability in cakephp authentication, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
Weakness: CWE-601
Which versions are affected by CVE-2026-55590?
6 open source packages ship an affected version, including cakephp/authentication. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cakephp/authentication Packagist | All versions | 2.11.1 |
cakephp/authentication Packagist | All versions | 2.11.1 |
cakephp/authentication Packagist | From 3.0.0 | 3.3.6 |
cakephp/authentication Packagist | From 3.0.0 | 3.3.6 |
cakephp/authentication Packagist | From 4.0.0 | 4.1.1 |
cakephp/authentication Packagist | From 4.0.0 | 4.1.1 |
Products include Cakephp Cakephp.
How do I fix CVE-2026-55590?
Upgrade cakephp/authentication to a fixed version for your release line: 2.11.1, 3.3.6 or 4.1.1.
Is CVE-2026-55590 being exploited?
There is no known exploitation of CVE-2026-55590 in the wild and no public exploit code.
Other vulnerabilities in cakephp authentication
- CVE-2023-22727 Database Query::offset() and limit() vulnerable to SQL injection in cakephp
- CVE-2020-35239 CakePHP allows method override parameters to bypass CSRF checks
- CVE-2015-8379 CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
- CVE-2019-11458 Unsafe deserialization in SmtpTransport in CakePHP
- CVE-2016-4793 CakePHP allows remote attackers to spoof their IP
Sources
Also known as GHSA-hhpq-7wg4-36jm.