The vulnerability resides in the CakePHP Authentication plugin’s getLoginRedirect() method. It allows an attacker to construct a redirect query string that contains backslashes to bypass the host validation logic. When a user follows such a redirect, the application will send them to an arbitrary external site controlled by the attacker. This constitutes an open redirect flaw (CWE‑601) that can be exploited for phishing, social‑engineering, or to deliver malware via misleading URLs. The flaw does not directly compromise the application’s data or services, but it undermines user trust and can facilitate downstream attacks.

All releases of the CakePHP Authentication plugin prior to version 2.11.1 for CakePHP 2, 3.3.6 for CakePHP 3, and 4.1.1 for CakePHP 4 are affected. The vulnerability has been fixed in those release numbers and any later releases.

The CVSS score of 5.1 classifies the issue as medium severity, while the EPSS of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves an attacker embedding a crafted redirect parameter into a URL or link that a user is sent to, after which the victim’s browser is redirected to a malicious destination. Because the redirect occurs after user authentication, an attacker must gain access to a page or link that triggers the redirect, but the method requires no special privileges beyond user interaction.