CakePHP Authentication EUVD-2026-65157

Exploitation requires that the target application uses the Authentication plugin's CookieAuthenticator ('remember me' cookie login) AND still accepts the legacy two-part token format ('legacyTokens' enabled, which is the default grace-period setting in unpatched code). The attacker must supply a cookie for a valid username but needs no password, session, or prior authentication (PR:N). Exploitation is LIMITED by: applications that do not use CookieAuthenticator at all are not affected; applications that have moved fully to the new HMAC token format or disabled legacy tokens are protected; and the CVSS AT:P flag reflects this required 'remember me' configuration as a precondition. No user interaction is required.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.1) indicates network, low-complexity, unauthenticated attack with high confidentiality and integrity impact, but crucially AT:P - a present attack requirement, namely that the target must use CookieAuthenticator and still accept legacy tokens. This is a genuine high-severity issue where exploitable, since forging a token yields full identity impersonation, but the AT:P requirement and the config/deployment dependency meaningfully narrow real-world exposure versus a raw 9.1. No EPSS score was provided, it is not KEV-listed, and no POC was supplied - so this is a serious-but-not-confirmed-exploited flaw, and prioritization should hinge on whether an application actually enables CookieAuthenticator legacy tokens. The description also cites CPU/memory exhaustion (an availability impact) that the provided vector scores as VA:N, a minor inconsistency worth noting.

An attacker who knows or guesses a valid username crafts a two-part legacy cookie containing a forged password hash in a weak crypt format that password_verify() accepts, and presents it to the application to be authenticated as that user without credentials. Alternatively they embed a bcrypt/argon2 hash with an extreme work factor to force password_verify() into heavy CPU or memory consumption, degrading the service. No public POC was provided, but the attack is network-reachable and low-complexity where legacy cookie tokens are accepted.