Summary
CVE-2026-77337 affects the CakePHP Authentication plugin (used standalone or with PSR-7 based applications). When the CookieAuthenticator component relies on unencrypted, forgeable legacy tokens, an attacker can bypass authentication and impersonate a legitimate user, and can also trigger CPU/memory exhaustion by submitting crafted tokens for validation. The issue is rated CRITICAL (CVSS 9.1).
Technical details
- Root cause:
CookieAuthenticatorsupports a legacy cookie token format that is not encrypted, allowing tokens to be forged without knowledge of any server-side secret. - Trigger condition: The application must have
CookieAuthenticatorenabled and configured to accept legacy (unencrypted) tokens rather than the newer encrypted cookie format. - Attack vector: Network — remote, unauthenticated attacker crafts a cookie value and submits it to the target application; no user interaction or prior privileges are required.
- Impact: Authentication bypass (impersonation of arbitrary users) via forged tokens (CWE-290), and denial of service through uncontrolled resource consumption when the server processes maliciously crafted tokens (CWE-770).
Affected software
cakephp/authenticationversions prior to 2.11.2cakephp/authenticationversions 3.0.0 through 3.3.6cakephp/authenticationversions 4.0.0 through 4.2.0
Severity
- CVSS v4.0 Base Score: 9.1 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: Upgrade
cakephp/authenticationto version 2.11.2, 3.3.7, or 4.2.1, which introduce an encrypted cookie format. - If patching is delayed: Enable the
EncryptedCookieMiddlewarefor the authentication cookie name to protect tokens in transit and at rest, and disable acceptance of legacy unencrypted tokens (legacyTokens = false) where supported.

