The CakePHP Authentication plugin contains a weakness in its getLoginRedirect() method prior to versions 2.11.1, 3.3.6, and 4.1.1. An attacker can craft a redirect query string that includes backslashes to bypass host validation, allowing the application to redirect users to attacker-controlled hostnames. This flaw is a classic open-redirect vulnerability (CWE-601) that can be exploited for phishing, social engineering, or delivery of malware via deceptive URLs. While it does not directly compromise the application’s data or services, it erodes user trust and can serve as a foothold for downstream attacks.

All releases of the CakePHP Authentication plugin prior to version 2.11.1 for CakePHP 2, 3.3.6 for CakePHP 3, and 4.1.1 for CakePHP 4 are affected. The vulnerability has been fixed in those release numbers and any later releases.

The CVSS score of 5.1 classifies the issue as medium severity, while the EPSS of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves an attacker embedding a crafted redirect parameter into a URL or link that a user is sent to, after which the victim’s browser is redirected to a malicious destination. Because the redirect occurs after user authentication, an attacker must gain access to a page or link that triggers the redirect, but the method requires no special privileges beyond user interaction.