Every CVE Search/ Get API key

CVE-2026-55590

CakePHP: Open redirect weakness via backslash bypass

5.1 MediumFix available

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.49%Down 0.1 points since Jul 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

CakePHP: Open redirect weakness via backslash bypass

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

Record
CVE-2026-55590
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-601
Updated
2026-11-02
EUVDEUVD-2026-42674 5.1

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

Record
EUVD-2026-42674
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hhpq-7wg4-36jm 5.1

CakePHP Authentication: Open redirect weakness via backslash bypass

Impact

The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.

Patches

2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.

Workarounds

If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.

Record
GHSA-hhpq-7wg4-36jm
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-601
Updated
2026-11-02
NVD 5.1

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

Record
CVE-2026-55590
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSV 5.1

CakePHP: Open redirect weakness via backslash bypass

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

Record
CVE-2026-55590
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-601
Updated
2026-11-02
OSVGHSA-hhpq-7wg4-36jm 5.1

CakePHP Authentication: Open redirect weakness via backslash bypass

Impact

The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.

Patches

2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.

Workarounds

If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.

Record
GHSA-hhpq-7wg4-36jm
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-601
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cakephp/authentication
Packagist
 4.0.0 up to 4.1.1
4.1.1
cakephp/authentication
Packagist
 3.0.0 up to 3.3.6
3.3.6
cakephp/authentication
Packagist
 before 2.11.1
2.11.1
cakephp/authentication
Packagist
 3.0.0 up to 3.3.6, plus listed versions
3.0.13.0.23.0.33.1.03.1.1
Show 12 moreShow less
3.2.03.2.13.2.23.2.33.2.43.2.53.3.03.3.13.3.23.3.33.3.43.3.5
3.3.6
cakephp/authentication
Packagist
 4.0.0 up to 4.1.1, plus listed versions
4.0.14.1.0
4.1.1
cakephp/authentication
Packagist
 before 2.11.1, plus listed versions
1.0.01.0.0-alpha11.0.0-beta11.0.0-beta21.0.0-beta3
Show 45 moreShow less
1.0.0-beta41.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.0-rc51.0.0-rc61.0.0-rc71.0.0-rc81.0.0-rc91.0.11.1.01.1.11.1.21.1.31.1.41.1.51.2.01.2.11.3.01.4.01.4.11.4.22.0.02.0.12.0.22.0.32.0.42.0.52.1.02.10.02.10.12.10.22.11.02.2.02.3.02.3.12.4.02.5.02.6.02.6.12.6.22.7.02.8.02.9.0
2.11.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55590 is a medium vulnerability (CVSS 5.1) in Cakephp Authentication, published June 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in cakephp/authentication 4.1.1.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open