Skip to main content

CakePHP Authentication CVE-2026-77337

| EUVDEUVD-2026-65157 CRITICAL
Authentication Bypass by Spoofing (CWE-290)
2026-08-24 GitHub_M
Authentication Bypass Authentication
9.1
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.1 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.4 CRITICAL

Unauthenticated network forging of a legacy cookie yields user impersonation (C:H/I:H); the described CPU/memory exhaustion warrants A:L; config dependence is a deployment precondition, not per-attack complexity, so AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 24, 2026 - 22:25 vuln.today
Analysis Generated
Aug 24, 2026 - 22:25 vuln.today
Patch available
Aug 24, 2026 - 22:02 EUVD
CVE Published
Aug 24, 2026 - 21:30 cve.org
CRITICAL 9.1

DescriptionCVE.org

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

AnalysisAI

Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify app using CookieAuthenticator legacy tokens
Delivery
Forge two-part cookie with weak/oversized hash
Exploit
Submit forged cookie to app
Execution
Bypass password_verify authentication check
Impact
Impersonate target user or exhaust CPU/memory
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application uses the Authentication plugin's CookieAuthenticator ('remember me' cookie login) AND still accepts the legacy two-part token format ('legacyTokens' enabled, which is the default grace-period setting in unpatched code). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.1) indicates network, low-complexity, unauthenticated attack with high confidentiality and integrity impact, but crucially AT:P - a present attack requirement, namely that the target must use CookieAuthenticator and still accept legacy tokens. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who knows or guesses a valid username crafts a two-part legacy cookie containing a forged password hash in a weak crypt format that password_verify() accepts, and presents it to the application to be authenticated as that user without credentials. Alternatively they embed a bcrypt/argon2 hash with an extreme work factor to force password_verify() into heavy CPU or memory consumption, degrading the service. …
Remediation Vendor-released patch: upgrade to 2.11.2, 3.3.7, or 4.2.1 depending on your major version (fix delivered in PRs https://github.com/cakephp/authentication/pull/806 and https://github.com/cakephp/authentication/pull/807, commit c94d9a5380e7f4fdf38d338a9de2223a5b087159; details in advisory https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all applications using CakePHP Authentication plugin versions before 2.11.2, 3.0.0-3.3.6, or 4.0.0-4.2.0. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-77337 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy