Suggestions search

Untriaged

Filter by:

With package: perl5Packages.CatalystAuthenticationCredentialHTTP

Found 2 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-77337

9.1 CRITICAL

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): Present (P)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Vulnerable System Impact Confidentiality (VC): High (H)
Vulnerable System Impact Integrity (VI): High (H)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): Present (P)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Vulnerable System Impact Confidentiality (MVC): High (H)
Modified Vulnerable System Impact Integrity (MVI): High (H)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 5 days, 22 hours ago Activity log

Created suggestion 5 days, 22 hours ago

CakePHP: Potential Authentication bypass with CookieAuthenticator

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

References

https://github.com/cakephp/authentication/security/advisories/GHSA-h7xh-9h2x-2m37 x_refsource_CONFIRM
https://github.com/cakephp/authentication/pull/806 x_refsource_MISC
https://github.com/cakephp/authentication/pull/807 x_refsource_MISC
https://github.com/cakephp/authentication/commit/c94d9a5380e7f4fdf38d338a9de2223a5b087159 x_refsource_MISC

Affected products

authentication

==>= 4.0.0, < 4.2.1
==>= 3.0.0, < 3.3.7
==< 2.11.2

Matching in nixpkgs

pkgs.matrix-authentication-service

OAuth2.0 + OpenID Provider for Matrix Homeservers

nixos-unstable 1.17.0
- nixpkgs-unstable 1.17.0
- nixos-unstable-small 1.23.0
nixos-26.05 1.17.0
- nixos-26.05-small 1.23.0
- nixpkgs-26.05-darwin 1.17.0

pkgs.perlPackages.MailAuthenticationResults

Object Oriented Authentication-Results Headers

nixos-unstable 2.20230112
- nixpkgs-unstable 2.20230112
- nixos-unstable-small 2.20230112
nixos-26.05 2.20230112
- nixos-26.05-small 2.20230112
- nixpkgs-26.05-darwin 2.20230112

pkgs.perl5Packages.MailAuthenticationResults

Object Oriented Authentication-Results Headers

nixos-unstable 2.20230112
- nixpkgs-unstable 2.20230112
- nixos-unstable-small 2.20230112
nixos-26.05 2.20230112
- nixos-26.05-small 2.20230112
- nixpkgs-26.05-darwin 2.20230112

pkgs.perlPackages.CatalystPluginAuthentication

Infrastructure plugin for the Catalyst authentication framework

nixos-unstable 0.10_027
- nixpkgs-unstable 0.10_027
- nixos-unstable-small 0.10_027
nixos-26.05 0.10_027
- nixos-26.05-small 0.10_027
- nixpkgs-26.05-darwin 0.10_027

pkgs.perl5Packages.CatalystPluginAuthentication

Infrastructure plugin for the Catalyst authentication framework

nixos-unstable 0.10_027
- nixpkgs-unstable 0.10_027
- nixos-unstable-small 0.10_027
nixos-26.05 0.10_027
- nixos-26.05-small 0.10_027
- nixpkgs-26.05-darwin 0.10_027

pkgs.perlPackages.CatalystAuthenticationStoreLDAP

Authenticate Users against LDAP Directories

nixos-unstable 1.017
- nixpkgs-unstable 1.017
- nixos-unstable-small 1.017
nixos-26.05 1.017
- nixos-26.05-small 1.017
- nixpkgs-26.05-darwin 1.017

pkgs.perl5Packages.CatalystAuthenticationStoreLDAP

Authenticate Users against LDAP Directories

nixos-unstable 1.017
- nixpkgs-unstable 1.017
- nixos-unstable-small 1.017
nixos-26.05 1.017
- nixos-26.05-small 1.017
- nixpkgs-26.05-darwin 1.017

pkgs.perlPackages.CatalystAuthenticationStoreHtpasswd

Authen::Htpasswd based user storage/authentication

nixos-unstable 1.006
- nixpkgs-unstable 1.006
- nixos-unstable-small 1.006
nixos-26.05 1.006
- nixos-26.05-small 1.006
- nixpkgs-26.05-darwin 1.006

pkgs.perl5Packages.CatalystAuthenticationStoreHtpasswd

Authen::Htpasswd based user storage/authentication

nixos-unstable 1.006
- nixpkgs-unstable 1.006
- nixos-unstable-small 1.006
nixos-26.05 1.006
- nixos-26.05-small 1.006
- nixpkgs-26.05-darwin 1.006

pkgs.perlPackages.CatalystAuthenticationCredentialHTTP

HTTP Basic and Digest authentication for Catalyst

nixos-unstable 1.018
- nixpkgs-unstable 1.018
- nixos-unstable-small 1.018
nixos-26.05 1.018
- nixos-26.05-small 1.018
- nixpkgs-26.05-darwin 1.018

pkgs.perlPackages.CatalystAuthenticationStoreDBIxClass

Extensible and flexible object <-> relational mapper

nixos-unstable 0.1506
- nixpkgs-unstable 0.1506
- nixos-unstable-small 0.1506
nixos-26.05 0.1506
- nixos-26.05-small 0.1506
- nixpkgs-26.05-darwin 0.1506

pkgs.perl5Packages.CatalystAuthenticationCredentialHTTP

HTTP Basic and Digest authentication for Catalyst

nixos-unstable 1.018
- nixpkgs-unstable 1.018
- nixos-unstable-small 1.018
nixos-26.05 1.018
- nixos-26.05-small 1.018
- nixpkgs-26.05-darwin 1.018

pkgs.perl5Packages.CatalystAuthenticationStoreDBIxClass

Extensible and flexible object <-> relational mapper

nixos-unstable 0.1506
- nixpkgs-unstable 0.1506
- nixos-unstable-small 0.1506
nixos-26.05 0.1506
- nixos-26.05-small 0.1506
- nixpkgs-26.05-darwin 0.1506

pkgs.python313Packages.microsoft-kiota-authentication-azure

Kiota Azure authentication provider

nixos-unstable 1.10.3
- nixpkgs-unstable 1.11.7
- nixos-unstable-small 1.11.9
nixos-26.05 1.10.1
- nixos-26.05-small 1.10.1
- nixpkgs-26.05-darwin 1.10.1

pkgs.python314Packages.microsoft-kiota-authentication-azure

Kiota Azure authentication provider

nixos-unstable 1.10.3
- nixpkgs-unstable 1.11.7
- nixos-unstable-small 1.11.9
nixos-26.05 1.10.1
- nixos-26.05-small 1.10.1
- nixpkgs-26.05-darwin 1.10.1

Package maintainers

@teutat3s teutat3s <teutates@mailbox.org>
@NickCao Nick Cao <nickcao@nichi.co>
@transcaffeine transcaffeine <transcaffeine@finally.coffee>
@Ma27 Maximilian Bosch <maximilian@mbosch.me>
@skowalak Sebastian Kowalak
@fabaff Fabian Affolter <mail@fabian-affolter.ch>

Permalink CVE-2026-55590

5.1 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Active (A)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): None (N)
Subsequent System Impact Confidentiality (SC): Low (L)
Subsequent System Impact Integrity (SI): Low (L)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Active (A)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): None (N)
Modified Subsequent System Impact Confidentiality (MSC): Low (L)
Modified Subsequent System Impact Integrity (MSI): Low (L)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

CakePHP: Open redirect weakness via backslash bypass

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLoginRedirect() method contains a weakness to backslash bypasses that allows redirect targets with attacker-controlled hostnames through the redirect query string parameter. This issue is fixed in versions 2.11.1, 3.3.6, and 4.1.1.