CVE-2026-77337

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159
https://github.com/cakephp/authentication/pull/806
https://github.com/cakephp/authentication/pull/807
https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) CakePHP Authentication es un plugin de autenticación para CakePHP que también puede ser usado en aplicaciones basadas en PSR-7. Las versiones anteriores a la 2.11.2, de la 3.0.0 a la 3.3.6, y de la 4.0.0 a la 4.2.0 permiten la omisión de autenticación y un posible agotamiento de CPU o memoria cuyo CookieAuthenticator utiliza tokens heredados no cifrados y falsificables. Este problema está solucionado en las versiones 2.11.2, 3.3.7 y 4.2.1.

Information

Published : 2026-08-24 22:17

Updated : 2026-10-12 15:10

NVD link : CVE-2026-77337

Mitre link : CVE-2026-77337

CVE.ORG link : CVE-2026-77337

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-77337", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77337", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T18:32:35.314141Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cakephp", "product": "authentication", "versions": [{"status": "affected", "version": "< 2.11.2"}, {"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 4.0.0, < 4.2.1"}]}]}], "published": "2026-08-24T22:17:19.510", "references": [{"url": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/authentication/pull/806", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/authentication/pull/807", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1."}, {"lang": "es", "value": "CakePHP Authentication es un plugin de autenticaci\u00f3n para CakePHP que tambi\u00e9n puede ser usado en aplicaciones basadas en PSR-7. Las versiones anteriores a la 2.11.2, de la 3.0.0 a la 3.3.6, y de la 4.0.0 a la 4.2.0 permiten la omisi\u00f3n de autenticaci\u00f3n y un posible agotamiento de CPU o memoria cuyo CookieAuthenticator utiliza tokens heredados no cifrados y falsificables. Este problema est\u00e1 solucionado en las versiones 2.11.2, 3.3.7 y 4.2.1."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "security-advisories@github.com"}