5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55590

CVE-2026-55590: CakePHP: Open redirect weakness via backslash bypass

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55590

CVE-2026-55590:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cakephp/authentication	composer	< 3.3.6	3.3.6
cakephp/authentication	composer	>= 4.0.0, < 4.1.1	4.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the getLoginRedirect method of the AuthenticationService class in the CakePHP authentication library. The security advisory explicitly mentions this method. By analyzing the commits that patch the vulnerability for versions 3.3.6 and 4.1.1, I confirmed the exact location of the flaw. The patches applied in commits df28ea4e712f1e5bd0e42be4a3c5c750ca50764d and ee24bd48b9c3ef693dc9965de8f0cc8020a7052c show changes directly within the getLoginRedirect function. The vulnerability is caused by insufficient validation of the redirect URL, specifically allowing backslashes to bypass the check for external domains. An attacker can craft a URL starting with backslashes (e.g., \\attacker.com) which parse_url does not recognize as having a host, but which browsers will treat as a redirect to an external domain. The fix involves normalizing backslashes to forward slashes and adding checks to prevent this bypass. Therefore, the AuthenticationService::getLoginRedirect function is the vulnerable function.

Vulnerable functions

AuthenticationService::getLoginRedirect

src/AuthenticationService.php

The `getLoginRedirect` function was vulnerable to an open redirect. It used `parse_url` on a user-provided redirect parameter without proper sanitization. An attacker could use backslashes in the redirect URL (e.g., `\\evil.com`) to bypass the host check in `parse_url`. When this URL is used in a `Location` header, many browsers interpret the backslashes and redirect to the external domain. The patch mitigates this by replacing backslashes with forward slashes and adding more stringent checks before parsing the URL.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.