What is GHSA-hhpq-7wg4-36jm?

GHSA-hhpq-7wg4-36jm is a security advisory published by GitHub Security Advisories with Medium severity. CakePHP Authentication: Open redirect weakness via backslash bypass

Which CVE IDs does GHSA-hhpq-7wg4-36jm cover?

GHSA-hhpq-7wg4-36jm covers the following CVE IDs: CVE-2026-55590. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-hhpq-7wg4-36jm?

GHSA-hhpq-7wg4-36jm affects 2 products, including: composer/cakephp/authentication:\u003c 3.3.6; composer/cakephp/authentication:\u003e= 4.0.0, \u003c 4.1.1.

GHSA-hhpq-7wg4-36jmMedium

CakePHP Authentication: Open redirect weakness via backslash bypass

Vendor

GitHub Security Advisories

Published

June 17, 2026

Last Modified

June 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-55590 →

📋 Description

Impact

The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.

Patches

3.3.6 and 4.1.1 contain a fix for this issue.

Workarounds

If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.

🎯 Affected products2

composer/cakephp/authentication:< 3.3.6
composer/cakephp/authentication:>= 4.0.0, < 4.1.1

🔗 References (2)

https://github.com/cakephp/authentication/security/advisories/GHSA-hhpq-7wg4-36jm
https://github.com/advisories/GHSA-hhpq-7wg4-36jm