Authentication Bypass Vulnerability in CakePHP Authentication Plugin
Summary
DEBIAN-CVE-2026-77337: CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Affects cakephp versions 2.10.11-2.1 – 2.10.24-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CakePHP is a popular open-source web application framework that follows the MVC (Model-View-Controller) architectural pattern. The CakePHP Authentication plugin provides a robust mechanism for managing user authentication in CakePHP applications and can also be utilized in PSR-7 based applications. This plugin is essential for ensuring secure user access and maintaining application integrity. However, certain versions of this plugin are vulnerable to an authentication bypass issue, which can lead to unauthorized access and potential resource exhaustion.
Vulnerability Detail
The vulnerability arises from the use of unencrypted, forgeable legacy tokens by the CookieAuthenticator in CakePHP Authentication. Versions prior to 2.11.2, as well as versions 3.0.0 through 3.3.6 and 4.0.0 through 4.2.0, are affected. This flaw allows attackers to bypass authentication mechanisms, which could lead to unauthorized access to sensitive data and potential CPU or memory exhaustion due to malicious requests. The issue is particularly severe as it compromises the fundamental security of applications relying on this plugin.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling the CookieAuthenticator or switching to a different authentication method until the plugin can be updated. However, this may expose your application to other risks, so it is recommended to apply the patch as soon as possible.
Conclusion
The authentication bypass vulnerability in the CakePHP Authentication plugin poses a significant risk to applications using affected versions. It is crucial for developers and system administrators to update to the latest patched versions to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for cakephp →
FAQ
Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 are affected.
The vulnerability can lead to authentication bypass, allowing unauthorized access to applications, and can also result in CPU or memory exhaustion.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the CookieAuthenticator or switching to a different authentication method as a temporary measure.
More information can be found in the CVE database under CVE-2026-77337 and the official CakePHP documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for cakephp.
