CVE-2026-55590: CakePHP Authentication: Open redirect weakness via backslash bypass
Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches 2.11.1, 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
Other sources
Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches 3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
— GitHub
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.
— MITRE
CakePHP Authentication: Open redirect weakness via backslash bypass
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/authenticationto a version that resolves this vulnerability.Fixed in 4.1.1 - Upgrade
Upgrade
composer/cakephp/authenticationto a version that resolves this vulnerability.Fixed in 3.3.6 - Upgrade
Upgrade
composer/cakephp/authenticationto a version that resolves this vulnerability.Fixed in 2.11.1 - Upgrade
Upgrade
CakePHP Authenticationto a version that resolves this vulnerability.Fixed in 2.11.1 - Upgrade
Upgrade
CakePHP Authenticationto a version that resolves this vulnerability.Fixed in 3.3.6 - Upgrade
Upgrade
CakePHP Authenticationto a version that resolves this vulnerability.Fixed in 4.1.1 - Compensating control
If unable to upgrade, add application validation to the redirect query string parameter to mitigate the open redirect vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55590?
CVE-2026-55590 has a reported risk score of 45.
What is the impact of CVE-2026-55590?
CVE-2026-55590 allows for backslash bypasses in the getLoginRedirect() method, enabling redirect targets with attacker-controlled hostnames.
How do I fix CVE-2026-55590?
To fix CVE-2026-55590, you should upgrade to version 3.3.6 or 4.1.1 of the composer/cakephp/authentication.
What if I cannot upgrade to fix CVE-2026-55590?
If an upgrade is not possible, you should implement application validation as a workaround for CVE-2026-55590.
What software is affected by CVE-2026-55590?
CVE-2026-55590 affects the composer/cakephp/authentication software.