By vendor

Cakephp vulnerabilities

Known CVEs affecting Cakephp products, prioritized by severity, with SEC.co remediation and detection guidance.

1 published vulnerability

• CVE-2026-55590MEDIUM 6.1

  CakePHP Authentication, a plugin used to handle user login flows in CakePHP and PSR-7 applications, has a flaw in how it validates redirect destinations after login. An attacker can craft a malicious link that tricks the redirect logic into sending users to an attacker-controlled website instead of a legitimate destination. The vulnerability exists because the code fails to properly block backslash characters used to disguise malicious URLs. Users who click a specially crafted link could be redirected to a phishing site or other attacker infrastructure, putting credentials or session data at risk.