Packagist/cakephp/authentication CVE-2026-55590: medium, EPSS 0.49%

CakePHP Authentication: Open redirect weakness via backslash bypass

Action: Upgrade cakephp/authentication to 2.11.1 or later.

composer require cakephp/authentication:3.3.6

composer require cakephp/authentication:4.1.1

composer require cakephp/authentication:2.11.1

Affected

Fixed versions

Sources

• osv: GHSA-hhpq-7wg4-36jm
• https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm
• https://nvd.nist.gov/vuln/detail/CVE-2026-55590
• https://github.com/cakephp/authentication/pull/795
• https://github.com/cakephp/authentication/pull/796
• https://github.com/cakephp/authentication/pull/799
• https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273
• https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d
• https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c
• https://github.com/cakephp/authentication
• https://github.com/cakephp/authentication/releases/tag/2.11.1
• https://github.com/cakephp/authentication/releases/tag/3.3.6
• https://github.com/cakephp/authentication/releases/tag/4.1.1

CVE-2026-55590 · published 2026-06-17T18:52:09Z · modified 2026-08-14T18:45:12.637567282Z · JSON