CVE-2026-77337

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77337", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T19:24:11.618Z", "datePublished": "2026-08-24T21:30:06.817Z", "dateUpdated": "2026-08-25T19:23:34.125Z"}, "containers": {"cna": {"title": "CakePHP: Potential Authentication bypass with CookieAuthenticator", "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "lang": "en", "description": "CWE-290: Authentication Bypass by Spoofing", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37"}, {"name": "https://github.com/cakephp/authentication/pull/806", "tags": ["x_refsource_MISC"], "url": "https://github.com/cakephp/authentication/pull/806"}, {"name": "https://github.com/cakephp/authentication/pull/807", "tags": ["x_refsource_MISC"], "url": "https://github.com/cakephp/authentication/pull/807"}, {"name": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159", "tags": ["x_refsource_MISC"], "url": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159"}], "affected": [{"vendor": "cakephp", "product": "authentication", "versions": [{"version": "< 2.11.2", "status": "affected"}, {"version": ">= 3.0.0, < 3.3.7", "status": "affected"}, {"version": ">= 4.0.0, < 4.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-24T21:30:06.817Z"}, "descriptions": [{"lang": "en", "value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1."}], "source": {"advisory": "GHSA-h7xh-9h2x-2m37", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T18:32:35.314141Z", "id": "CVE-2026-77337", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T19:23:34.125Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77337", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T18:32:35.314141Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T18:32:38.169Z"}}], "cna": {"title": "CakePHP: Potential Authentication bypass with CookieAuthenticator", "source": {"advisory": "GHSA-h7xh-9h2x-2m37", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cakephp", "product": "authentication", "versions": [{"status": "affected", "version": "< 2.11.2"}, {"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 4.0.0, < 4.2.1"}]}], "references": [{"url": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37", "name": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cakephp/authentication/pull/806", "name": "https://github.com/cakephp/authentication/pull/806", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cakephp/authentication/pull/807", "name": "https://github.com/cakephp/authentication/pull/807", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159", "name": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-24T21:30:06.817Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77337", "state": "PUBLISHED", "dateUpdated": "2026-08-25T19:23:34.125Z", "dateReserved": "2026-08-20T19:24:11.618Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-24T21:30:06.817Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "authentication", "vendor": "cakephp", "versions": [{"status": "affected", "version": "< 2.11.2"}, {"status": "affected", "version": ">= 3.0.0, < 3.3.7"}, {"status": "affected", "version": ">= 4.0.0, < 4.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1."}, {"lang": "es", "value": "CakePHP Authentication es un plugin de autenticaci\u00f3n para CakePHP que tambi\u00e9n puede ser usado en aplicaciones basadas en PSR-7. Las versiones anteriores a la 2.11.2, de la 3.0.0 a la 3.3.6, y de la 4.0.0 a la 4.2.0 permiten la omisi\u00f3n de autenticaci\u00f3n y un posible agotamiento de CPU o memoria cuyo CookieAuthenticator utiliza tokens heredados no cifrados y falsificables. Este problema est\u00e1 solucionado en las versiones 2.11.2, 3.3.7 y 4.2.1."}], "id": "CVE-2026-77337", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77337", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T18:32:35.314141Z", "version": "2.0.3"}}]}, "published": "2026-08-24T22:17:19.510", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159"}, {"source": "security-advisories@github.com", "url": "https://github.com/cakephp/authentication/pull/806"}, {"source": "security-advisories@github.com", "url": "https://github.com/cakephp/authentication/pull/807"}, {"source": "security-advisories@github.com", "url": "https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.3.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "authentication", "source": "cna", "vendor": "cakephp"}, "product": "authentication", "vendor": "cakephp"}], "created": "2026-08-24T22:30:04.101989+00:00", "updated": "2026-08-24T22:45:03.402544+00:00", "vendors": ["cakephp", "cakephp$PRODUCT$authentication"]}