CVE-2026-77337 CakePHP: Potential Authentication bypass with CookieAuthenticator
Attackers can bypass authentication and cause resource exhaustion by exploiting forgeable legacy tokens in the CakePHP CookieAuthenticator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77337?
CVE-2026-77337 is a critical authentication bypass vulnerability in cakephp authentication, published on 24 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Which versions are affected by CVE-2026-77337?
How do I fix CVE-2026-77337?
No fix has been published for CVE-2026-77337 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-77337 being exploited?
There is no known exploitation of CVE-2026-77337 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-77337, GHSA-h7xh-9h2x-2m37, UBUNTU-CVE-2026-77337.