Authentication
Monthly
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).