CRITICAL 9.1 NVD
CVE-2026-77337
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
References
- https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159
- https://github.com/cakephp/authentication/pull/806
- https://github.com/cakephp/authentication/pull/807
- https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37
This critical severity vulnerability with a CVSS score of 9.1 was published on 2026-08-24 via NVD.
Risk Timeline
CVE Disclosed2026-08-24 · 0 days ago
Remediation Resources
vulnfeed aggregates 11222 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.