CVE-2026-55590: CakePHP: Open redirect weakness via backslash bypass
Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
Other sources
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/authenticationto a version that resolves this vulnerability.Fixed in 4.1.1 - Upgrade
Upgrade
composer/cakephp/authenticationto a version that resolves this vulnerability.Fixed in 3.3.6 - Upgrade
Upgrade
CakePHP Authentication pluginto a version that resolves this vulnerability.Fixed in 2.11.1 - Upgrade
Upgrade
CakePHP Authentication pluginto a version that resolves this vulnerability.Fixed in 3.3.6 - Upgrade
Upgrade
CakePHP Authentication pluginto a version that resolves this vulnerability.Fixed in 4.1.1 - Configuration
If unable to upgrade, add application validation to the redirect query string parameter to mitigate the open redirect weakness caused by backslash bypasses in getLoginRedirect().
Application redirect handling for login redirect Application validation of the redirect query string parameter = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55590?
CVE-2026-55590 has a reported risk score of 45.
What is the impact of CVE-2026-55590?
CVE-2026-55590 allows for backslash bypasses in the getLoginRedirect() method, enabling redirect targets with attacker-controlled hostnames.
How do I fix CVE-2026-55590?
To fix CVE-2026-55590, you should upgrade to version 3.3.6 or 4.1.1 of the composer/cakephp/authentication.
What if I cannot upgrade to fix CVE-2026-55590?
If an upgrade is not possible, you should implement application validation as a workaround for CVE-2026-55590.
What software is affected by CVE-2026-55590?
CVE-2026-55590 affects the composer/cakephp/authentication software.