CakePHP Authentication allows user authentication via CookieAuthenticator. In versions prior to 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0, the plugin accepts unencrypted legacy tokens that can be forged. This flaw permits an attacker to bypass authentication, granting access to the application, and can also lead to CPU or memory exhaustion due to poorly validated token processing. The vulnerability is linked to CWE-290 (Improper Authentication) and CWE-770 (Resource Exhaustion).

The affected product is the CakePHP Authentication plugin from the CakePHP community. Systems running CakePHP Framework that incorporate the authentication plugin versions listed above are impacted. This includes web applications built on PHP using CakePHP, as well as any PSR-7 compatible applications that integrate the plugin. Versions 2.11.2, 3.3.7, and 4.2.1 and later contain the fix.

The CVSS score of 9.1 indicates a critical severity. EPSS is not available, and the vulnerability is not currently listed in CISA KEV. Based on the description, the likely attack vector is through a crafted HTTP cookie sent to the application. An attacker could inject a forged cookie to achieve authentication bypass, and if the application processes numerous forged tokens, the attacker could also trigger excessive CPU or memory usage. Mitigation requires patching or reconfiguring the authentication token handling.