Threat database

CVE-2026-54713 is a low-severity vulnerability in CakePHP Queue versions from 0.1.11 up to but not including 2.3.1. The issue arises because the QueueManager::getUniqueId() method generates job identifiers by sorting parameter values but drops associative-array keys, causing semantically different job parameters to produce identical identifiers. This can lead to legitimate jobs being incorrectly dropped as duplicates when the shouldBeUnique feature is enabled. The vulnerability is fixed in version 2.3.1.

CVE-2026-54614 is a medium severity vulnerability in the CakePHP DebugKit component affecting versions prior to 4.10.3 and 5.2.4. The vulnerability involves unsafe reflection in the MailPreview feature, where an attacker with access to DebugKit in debug mode and from a local or allowlisted hostname can cause arbitrary constructor execution by manipulating the previewName parameter. This can lead to limited disclosure of application information. The issue is fixed in DebugKit versions 4.10.3 and 5.2.4.

CakePHP Authentication versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 contain a vulnerability that allows authentication bypass and potential CPU or memory exhaustion when using the CookieAuthenticator with unencrypted, forgeable legacy tokens. This issue is resolved in versions 2.11.2, 3.3.7, and 4.2.1.

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.