CVE-2026-77337criticalCWE-290CWE-770

CVE-2026-77337: falha crítica em cakephp authentication

CakePHP: Potential Authentication bypass with CookieAuthenticator

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar authentication+ Monitorar cakephp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.7%
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
cakephp · authentication
CVEs relacionadas — cakephp authentication

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55590MEDIUMCakePHP: Open redirect weakness via backslash bypassEPSS 0.5%