CVE-2026-55590

Name of the Vulnerable Software and Affected Versions CakePHP Authentication versions prior to 2.11.1 CakePHP Authentication versions prior to 3.3.6 CakePHP Authentication versions prior to 4.1.1

Description The getLoginRedirect() function contains a weakness to backslash bypasses. This allows redirect targets with attacker-controlled hostnames to be processed through the redirect query string parameter.

Recommendations Update to version 2.11.1. Update to version 3.3.6. Update to version 4.1.1. As a mitigation measure, add application validation to the redirect query string parameter.