CVE-2026-55590: CakePHP Authentication Open Redirect Vulnerability (CVSS 6.1)

Technical summary

CVE-2026-55590 is an open redirect vulnerability (CWE-601) in the getLoginRedirect() method of CakePHP Authentication prior to versions 2.11.1, 3.3.6, and 4.1.1. The flaw stems from insufficient validation of the redirect query string parameter. Specifically, the validation logic does not properly reject backslash characters, which can be abused to bypass hostname checks. By crafting a redirect parameter containing a backslash followed by an attacker-controlled domain, an unauthenticated attacker can cause the application to redirect authenticated users to arbitrary external URLs. The vulnerability is network-accessible and requires user interaction (clicking a malicious link) to trigger.

Business impact

This vulnerability enables credential harvesting and session hijacking through post-login redirect attacks. An attacker sends a victim a crafted link to the legitimate CakePHP application; after the user authenticates, they are redirected to an attacker-controlled phishing page that harvests credentials or steals session cookies. This damages user trust, increases support burden, and can lead to account compromise. The impact is elevated for applications where users share sensitive data or control critical resources through CakePHP-based systems. Organizations with customer-facing login flows are at particular risk.

Affected systems

CakePHP Authentication plugin versions prior to 2.11.1 (2.x branch), 3.3.6 (3.x branch), and 4.1.1 (4.x branch) are affected. Any application using this plugin for authentication—whether built on CakePHP or a PSR-7 compliant framework—may be vulnerable. Verify your installed version against your vendor advisory to determine exposure. Legacy projects still on unsupported 2.x versions are at higher risk due to longer support cycles.

Exploitability

Exploitability is straightforward but requires social engineering. The attack vector is network-accessible (AV:N) with low complexity (AC:L) and no privilege requirements (PR:N). However, user interaction (UI:R) is mandatory—an attacker must trick a user into clicking a specially crafted link. No advanced tooling is needed; a simple URL with a backslash-injected redirect parameter suffices. The widespread deployment of CakePHP in production applications makes this a practical threat despite the social engineering requirement.

Remediation

Upgrade to CakePHP Authentication 2.11.1, 3.3.6, or 4.1.1 (or later) depending on your branch. These versions implement proper validation to reject backslash characters and other bypass techniques in the redirect parameter. Test thoroughly in a staging environment before production deployment, particularly if you have custom authentication middleware that may interact with the redirect logic.

Patch guidance

Consult the official CakePHP security advisory and release notes for your branch (2.x, 3.x, or 4.x) to confirm the exact patched version number and any breaking changes. Update through your package manager (Composer) using 'composer update cakephp/authentication' and verify the new version matches the fixed release. Some deployments may require updating composer.json constraints and running 'composer install' in production. Test login flows end-to-end after patching to ensure redirects behave as expected.

Detection guidance

Monitor application logs for redirect query parameters containing backslash characters (e.g., '...?redirect=\\attacker.com'). Inspect referrer headers and redirect destinations in web server logs for suspicious patterns. Review CakePHP authentication logs for unusual redirect attempts. Implement a Web Application Firewall (WAF) rule to block HTTP requests with encoded or literal backslashes in redirect parameters. Conduct a code review of any custom redirect handling that supplements CakePHP Authentication to ensure similar bypasses do not exist.

Why prioritize this

While the CVSS score is MEDIUM (6.1), the practical impact justifies higher prioritization for customer-facing or sensitive applications. Open redirect vulnerabilities are frequently chained with phishing campaigns and are trivial to exploit once a victim is social-engineered. The presence of multiple supported branches (2.x, 3.x, 4.x) means some deployments may inadvertently remain on unpatched versions. Organizations relying on CakePHP for authentication should patch within 30 days, with faster timelines for publicly exposed login portals.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects network accessibility and low attack complexity offset by the requirement for user interaction and limited scope of impact (credential and integrity compromise but no availability impact). The score does not fully capture the value of the credentials or data accessible after redirect, which varies by application. Adjust your internal risk rating upward if the CakePHP application protects high-value accounts, financial transactions, or personal data.

Frequently asked questions