CVE-2026-77337: CakePHP: Potential Authentication bypass with CookieAuthenticator
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 2.11.2 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 3.3.7 - Upgrade
Upgrade
CakePHPto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using CakePHP Authentication's CookieAuthenticator are affected if they run a version before 2.11.2, a 3.x version from 3.0.0 through 3.3.6, or a 4.x version from 4.0.0 through 4.2.0 and use unencrypted, forgeable legacy tokens.
What must an attacker be able to do to exploit this issue?
The issue applies when CookieAuthenticator accepts unencrypted, forgeable legacy tokens. Under that condition, an attacker may bypass authentication and potentially cause CPU or memory exhaustion.
What versions remediate the issue?
Upgrade to CakePHP Authentication 2.11.2, 3.3.7, or 4.2.1, as appropriate for the deployed major version.