GHSA-hhpq-7wg4-36jm

Source

https://github.com/advisories/GHSA-hhpq-7wg4-36jm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hhpq-7wg4-36jm/GHSA-hhpq-7wg4-36jm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hhpq-7wg4-36jm

Aliases

CVE-2026-55590

Published

2026-06-17T18:52:09Z

Modified

2026-08-14T18:45:12Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

CakePHP Authentication: Open redirect weakness via backslash bypass

Details

Impact

The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.

Patches

2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.

Workarounds

If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-601"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-17T18:52:09Z",
    "nvd_published_at":  "2026-07-09T19:17:06Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / cakephp/authentication

Package

Name: cakephp/authentication
Purl: pkg:composer/cakephp/authentication

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0

Fixed

3.3.6

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.1.0

3.1.1

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hhpq-7wg4-36jm/GHSA-hhpq-7wg4-36jm.json"

Packagist / cakephp/authentication

Package

Name: cakephp/authentication
Purl: pkg:composer/cakephp/authentication

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.1.1

Affected versions

4.*

4.0.0

4.0.1

4.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hhpq-7wg4-36jm/GHSA-hhpq-7wg4-36jm.json"

Packagist / cakephp/authentication

Package

Name: cakephp/authentication
Purl: pkg:composer/cakephp/authentication

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.11.1

Affected versions

1.*

1.0.0-alpha1

1.0.0-beta1

1.0.0-beta2

1.0.0-beta3

1.0.0-beta4

1.0.0-rc1

1.0.0-rc2

1.0.0-rc3

1.0.0-rc4

1.0.0-rc5

1.0.0-rc6

1.0.0-rc7

1.0.0-rc8

1.0.0-rc9

1.0.0

1.0.1

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.2.0

1.2.1

1.3.0

1.4.0

1.4.1

1.4.2

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.1.0

2.2.0

2.3.0

2.3.1

2.4.0

2.5.0

2.6.0

2.6.1

2.6.2

2.7.0

2.8.0

2.9.0

2.10.0

2.10.1

2.10.2

2.11.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hhpq-7wg4-36jm/GHSA-hhpq-7wg4-36jm.json"