{"id":"CVE-2026-55590","title":"CakePHP Authentication: Open redirect weakness via backslash bypass","summary":"CakePHP Authentication: Open redirect weakness via backslash bypass","severity":"medium","cwe":["CWE-601"],"vendor":"cakephp","product":"cakephp/authentication","ecosystem":"composer","affected":["cakephp/authentication < 3.3.6","cakephp/authentication >= 4.0.0, < 4.1.1"],"patched":["cakephp/authentication 3.3.6","cakephp/authentication 4.1.1"],"published":"2026-06-17","updated":"2026-06-20","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-hhpq-7wg4-36jm","references":[{"url":"https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm"},{"url":"https://github.com/advisories/GHSA-hhpq-7wg4-36jm"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-29T14:31:47.169Z","epss":0.00491,"epssPercentile":0.39602,"slug":"CVE-2026-55590","body":"## Overview\n\n### Impact\nThe `getLoginRedirect()` method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.\n\n### Patches\n3.3.6 and 4.1.1 contain a fix for this issue.\n\n### Workarounds\nIf you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.\n\n## Affected packages\n\n- `cakephp/authentication < 3.3.6`\n- `cakephp/authentication >= 4.0.0, < 4.1.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `cakephp/authentication 3.3.6`\n- `cakephp/authentication 4.1.1`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}