AIKIDO-2026-829650
cakephp/authentication is vulnerable to Authentication Bypass
100
Critical Risk
This Affects:
cakephp/authenticationTL;DR
The CookieAuthenticator component persists the authentication identity in a cookie whose contents are not cryptographically verified when cookie encryption is not enabled. Because the token is not authenticated, user-controlled cookie values can be forged to impersonate arbitrary identities and pass authentication without valid credentials. Malformed tokens can additionally drive legacy password hashing with unbounded work factors, causing CPU and memory exhaustion. The fix introduces a verified three-part HMAC-SHA256 token format with expiry and strict shape validation and caps legacy hash work factors.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the CookieAuthenticator without cookie encryption enabled for its cookie.
Background info
cakephp/authentication is vulnerable to Authentication Bypass in versions 0.0.1 - 2.11.1, 3.0.0 - 3.3.6 and 4.0.0 - 4.2.0.
How to fix this
Upgrade the cakephp/authentication library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant