CVE-2026-77337

CakePHP: Potential Authentication bypass with CookieAuthenticator

State: Published
Severity: 9.1 Critical
Published: Aug 24, 2026
Updated: Aug 25, 2026
Reserved: Aug 20, 2026

Description

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

Scores

CVSS	Score	Vector	Source
4.0	9.1 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-290 Authentication Bypass by Spoofing
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
authenticationcakephp	< 2.11.2Affected >= 3.0.0, < 3.3.7Affected >= 4.0.0, < 4.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.