CVE-2026-77337CWE-290CWE-770denial-of-service

CVE-2026-77337

published August 25, 2026

CVSS
9.1
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

The record
Technical detail
CVSS
9.1 · NONE
CVSS v4.0
9.1 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00698 · 52.5th percentile
Weaknesses
CWE-290 · Authentication Bypass by Spoofing; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-25T02:17Z
References (4)
https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159 · [email protected]https://github.com/cakephp/authentication/pull/806 · [email protected]https://github.com/cakephp/authentication/pull/807 · [email protected]https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37 · [email protected]
EPSS history
Timeline
  • 26 AUG 08:27Z
    EPSS moved — → 0%
    epss
  • 24 AUG 21:30Z
    CakePHP: Potential Authentication bypass with CookieAuthenticator
    cvelistv5