CVE-2026-55590

Katalog CVE

CVSS 6.1 · Medium EPSS 0,49%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada cakephp. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm advisory vendor
• https://github.com/cakephp/authentication/commit/1c1e29c7e8129cfbcae74558316ecd3ea50a8273 patch
• https://github.com/cakephp/authentication/commit/df28ea4e712f1e5bd0e42be4a3c5c750ca50764d patch
• https://github.com/cakephp/authentication/commit/ee24bd48b9c3ef693dc9965de8f0cc8020a7052c patch
• https://github.com/cakephp/authentication/pull/795 issue tracking · patch
• https://github.com/cakephp/authentication/pull/796 issue tracking · patch
• https://github.com/cakephp/authentication/pull/799 issue tracking · patch
• https://github.com/cakephp/authentication/releases/tag/2.11.1 release notes
• https://github.com/cakephp/authentication/releases/tag/3.3.6 release notes
• https://github.com/cakephp/authentication/releases/tag/4.1.1 release notes