Authentication Bypass in CakePHP Authentication Plugin by CakePHP
CVE-2026-77337
9.1CRITICAL
What is CVE-2026-77337?
The CakePHP Authentication plugin contains a significant vulnerability that allows attackers to bypass authentication mechanisms. This issue arises when the CookieAuthenticator component utilizes unencrypted, forgeable legacy tokens. Such exploitation can lead to unauthorized access and potential CPU or memory exhaustion. This vulnerability is addressed in subsequent versions 2.11.2, 3.3.7, and 4.2.1, which mitigate the risk by enhancing the handling of authentication tokens.
Affected Version(s)
authentication < 2.11.2 < 2.11.2
authentication >= 3.0.0, < 3.3.7 < 3.0.0, 3.3.7
authentication >= 4.0.0, < 4.2.1 < 4.0.0, 4.2.1