CVE-2026-77337: CakePHP: Potential Authentication bypass with CookieAuthenticator

Severity: critical (CVSS 9.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-24 · updated 2026-10-12
Weakness: CWE-290

Description

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

Affected products

cakephp authentication: before 2.11.2; from 3.0.0, < 3.3.7; from 4.0.0, < 4.2.1

References

https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159
https://github.com/cakephp/authentication/pull/806
https://github.com/cakephp/authentication/pull/807
https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37

Get alerted when CVE-2026-77337 or the next vulnerability affects your stack