CVE-2026-77337 Overview
CVE-2026-77337 affects the CakePHP Authentication plugin, an authentication component for CakePHP and PSR-7 based applications. The vulnerability allows authentication bypass and potential CPU or memory exhaustion when the CookieAuthenticator processes unencrypted, forgeable legacy tokens. Affected versions include releases prior to 2.11.2, 3.0.0 through 3.3.6, and 4.0.0 through 4.2.0. The issue is categorized under [CWE-290] (Authentication Bypass by Spoofing). Fixed releases are 2.11.2, 3.3.7, and 4.2.1.
Critical Impact
Remote unauthenticated attackers can forge legacy cookie tokens to bypass authentication and trigger resource exhaustion in vulnerable CakePHP applications.
Affected Products
- CakePHP Authentication plugin versions before 2.11.2
- CakePHP Authentication plugin versions 3.0.0 through 3.3.6
- CakePHP Authentication plugin versions 4.0.0 through 4.2.0
Discovery Timeline
- 2026-08-24 - CVE-2026-77337 published to the National Vulnerability Database (NVD)
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-77337
Vulnerability Analysis
The flaw resides in the CookieAuthenticator component of the CakePHP Authentication plugin. When the authenticator accepts unencrypted legacy tokens, an attacker can construct a valid-looking cookie without possessing any secret material. The server then treats the forged token as evidence of a legitimate session and authenticates the request. This turns cookie-based persistent login into a trust boundary that a network-adjacent attacker can cross without credentials.
Beyond bypass, the same code path can be abused to force expensive parsing or verification work. Repeatedly submitting crafted legacy tokens drives the process into elevated CPU or memory consumption, degrading availability for legitimate users.
Root Cause
The root cause is a design weakness classified under [CWE-290]. The CookieAuthenticator relies on legacy token formats that lack cryptographic integrity protection. Because the token is not encrypted or signed with a server-side secret, its contents can be spoofed. The fix in versions 2.11.2, 3.3.7, and 4.2.1 removes trust in unencrypted legacy tokens and enforces authenticated token handling.
Attack Vector
Exploitation occurs over the network with no privileges and no user interaction. An attacker crafts a cookie payload matching the legacy token structure expected by CookieAuthenticator and sends it to any endpoint protected by cookie authentication. Successful spoofing yields an authenticated session tied to the target identity. Automated submission of malformed tokens produces resource exhaustion as a secondary effect. See the GitHub Security Advisory GHSA-h7xh-9h2x-2m37 for technical details.
Detection Methods for CVE-2026-77337
Indicators of Compromise
- Requests presenting authentication cookies that decode to legacy token formats rather than the current encrypted structure.
- Multiple successful authentications for the same user from unrelated source IP addresses within short intervals.
- Sudden spikes in CPU or memory consumption on PHP-FPM or worker processes handling authentication endpoints.
- Application log entries showing CookieAuthenticator accepting sessions without a preceding credential submission.
Detection Strategies
- Inventory application dependencies to identify installations of cakephp/authentication at versions below 2.11.2, between 3.0.0 and 3.3.6, or between 4.0.0 and 4.2.0.
- Enable verbose logging on authentication events and alert on cookie-based logins that lack a corresponding prior credential-based login.
- Correlate cookie authentication events with user-agent, IP, and geolocation baselines to surface spoofed sessions.
Monitoring Recommendations
- Monitor web server access logs for high-volume requests carrying authentication cookies against login-protected routes.
- Track process-level resource metrics for PHP workers serving CakePHP applications to detect exhaustion patterns.
- Alert on repeated 5xx responses or timeouts originating from authentication middleware.
How to Mitigate CVE-2026-77337
Immediate Actions Required
- Upgrade cakephp/authentication to version 2.11.2, 3.3.7, or 4.2.1 depending on the branch currently deployed.
- Invalidate all outstanding persistent-login cookies to force re-authentication after upgrade.
- Audit recent authentication logs for sessions established without corresponding credential submissions and terminate suspicious sessions.
Patch Information
The maintainers released fixed versions 2.11.2, 3.3.7, and 4.2.1. The remediation is tracked in GitHub Pull Request #806 and GitHub Pull Request #807, with the corrective change in commit c94d9a5. Full remediation guidance is documented in GitHub Security Advisory GHSA-h7xh-9h2x-2m37.
Workarounds
- Disable the CookieAuthenticator component until the upgrade can be applied, forcing users to authenticate via credentials each session.
- Configure the application to reject legacy token formats at a middleware layer if disabling cookie authentication is not feasible.
- Deploy WAF rules to rate-limit and inspect requests carrying authentication cookies to reduce resource-exhaustion risk.
# Configuration example
composer require cakephp/authentication:^4.2.1
# or for the 3.x branch
composer require cakephp/authentication:^3.3.7
# or for the 2.x branch
composer require cakephp/authentication:^2.11.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
