Junglewise Threat Intelligence

CVE-2026-55590: CakePHP Authentication open redirect in getLoginRedirect

CVE-2026-55590 · Severity: medium · CVSS 4 · Published 2026-07-09

Vendors: Cakephp.

Executive brief

The CakePHP Authentication plugin, used to manage user logins in web applications, contains a security flaw that allows for 'open redirects.' An attacker can craft a malicious link that appears to belong to a trusted website but instead redirects the user to a fraudulent or malicious external site after they log in. This technique is commonly used in phishing campaigns to steal user credentials or distribute malware by exploiting the user's trust in the original website.

Technical details

An open redirect vulnerability (CWE-601) exists in the `getLoginRedirect()` method of the CakePHP Authentication plugin. The vulnerability stems from a 'backslash bypass' where the plugin fails to properly sanitize backslashes in the redirect query string parameter. Because many modern browsers normalize backslashes (`\`) to forward slashes (`/`) when processing the `Location` header, an attacker can bypass internal redirect filters to send users to an arbitrary external hostname. This can be exploited by a remote, unauthenticated attacker who convinces a user to click a specially crafted link. The issue is resolved in versions 2.11.1, 3.3.6, and 4.1.1 by normalizing backslashes and rejecting leading double-slashes in the redirect path.

Affected products

  • cakephp authentication < 2.11.1
  • cakephp authentication >= 3.0.0, < 3.3.6
  • cakephp authentication >= 4.0.0, < 4.1.1

Timeline

  • 2026-06-13: patched: Initial fix committed to 4.x branch
  • 2026-07-09: disclosed: CVE published and advisory released

References