{"action":"Upgrade cakephp/authentication to 2.11.1 or later.","affected":[{"fixed":"3.3.6","introduced":"3.0.0"},{"fixed":"4.1.1","introduced":"4.0.0"},{"fixed":"2.11.1","introduced":"0"}],"component":"cakephp/authentication","cve_ids":["CVE-2026-55590"],"ecosystem":"Packagist","epss":0.00491,"exploited":false,"fixed_versions":["3.3.6","4.1.1","2.11.1"],"ghsa_id":"GHSA-hhpq-7wg4-36jm","id":"tcs_01M5KF3PJDPP09S17H1HAWMDP4","modified_at":"2026-08-14T18:45:12.637567282Z","published_at":"2026-06-17T18:52:09Z","references":["https://osv.dev/vulnerability/GHSA-hhpq-7wg4-36jm","https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm","https://nvd.nist.gov/vuln/detail/CVE-2026-55590","https://github.com/cakephp/authentication/pull/795","https://github.com/cakephp/authentication/pull/796","https://github.com/cakephp/authentication/pull/799","https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273","https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d","https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c","https://github.com/cakephp/authentication","https://github.com/cakephp/authentication/releases/tag/2.11.1","https://github.com/cakephp/authentication/releases/tag/3.3.6","https://github.com/cakephp/authentication/releases/tag/4.1.1"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hhpq-7wg4-36jm","url":"https://osv.dev/vulnerability/GHSA-hhpq-7wg4-36jm"}],"summary":"CakePHP Authentication: Open redirect weakness via backslash bypass"}