CVE-2026-77337None▾ SunlitCakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CP…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
0.4% → 0.7%
Last analysed / modified upstream
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118653Medium· 5.3Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
CVE-2026-86391Medium· 6.4Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 throu…
CVE-2026-25660CriticalCodechecker has an authentication bypass for certain API calls
CVE-2026-82117Critical· 9.8Authentication Bypass by Spoofing Vulnerability in HiRDB
CVE-2026-76938Critical· 9.8Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3
CVE-2026-107147Medium· 6.3Authentication bypass by spoofing in twofactor_gauthenticator