EUVD-2026-42674
GHSA-hhpq-7wg4-36jm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered URL requires victim interaction (UI:R); no attacker privileges needed; limited confidentiality impact from phishing; no server integrity or availability impact.
Primary rating from Vendor (https://github.com/cakephp/authentication).
CVSS VectorVendor: https://github.com/cakephp/authentication
Lifecycle Timeline
3DescriptionCVE.org
Impact
The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.
Patches
3.3.6 and 4.1.1 contain a fix for this issue.
Workarounds
If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.
AnalysisAI
Open redirect in CakePHP Authentication's getLoginRedirect() method exposes users of affected applications to attacker-controlled redirects via backslash character bypass of hostname validation logic. Applications running cakephp/authentication below 3.3.6 (3.x branch) or between 4.0.0 and 4.1.1 (4.x branch) are vulnerable. No public exploit code or CISA KEV listing has been identified at time of analysis, though the backslash bypass technique is well-understood and lowers the bar for exploitation against unpatched deployments.
Technical ContextAI
The vulnerability resides in the getLoginRedirect() method of the CakePHP Authentication Composer package (cakephp/authentication), a widely used authentication plugin for the CakePHP PHP framework. CWE-601 (URL Redirection to Untrusted Site) describes flaws where user-supplied input drives redirect target construction without adequate validation. The specific vector here is a backslash bypass: some URL parsers and browser implementations treat \ as equivalent to /, meaning a value such as \\attacker.com/path can be interpreted as //attacker.com/path by the browser after the server-side validation has already passed it as a relative path. If getLoginRedirect() checks for leading slashes or known-safe patterns without first normalizing backslashes, the check is trivially circumvented. This is a documented bypass class for open redirect mitigations, distinct from more complex techniques.
RemediationAI
Upgrade cakephp/authentication to version 3.3.6 (for 3.x installations) or 4.1.1 (for 4.x installations), as confirmed by the vendor advisory at https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm. Run composer update cakephp/authentication after updating the version constraint in composer.json. If an immediate upgrade is not feasible, the vendor recommends adding application-level validation of the redirect query string parameter. Any such custom validation must normalize backslashes (replacing \ with /) before performing hostname or path checks - skipping normalization will replicate the same bypass and provide no real protection. An allowlist of permitted redirect paths or hostnames is the most robust compensating control; a blocklist approach is insufficient given the variety of encoding bypass techniques in this class.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today