Repository navigation
2.x affected by CVE-2026-55590 #798
Description
At the moment composer refuses to install cakephp/authentication 2.x because it is affected by CVE-2026-55590. The wiki says that 2.x is not EOL yet. Do you have plans to backport the fix to 2.x as well?
Reacted by Simon
Activity
jiru commentedon Jun 26, 2026
@markstory Thank you very much! I can see you released 2.11.1 with the fix, but composer still refuses to install it. Version 2.11.1 is still marked as affected by the CVE on packagist.org.
markstory commentedon Jun 29, 2026
I don't know how to fix that. The security advisory has been updated with revised version ranges.
jiru commentedon Jun 29, 2026
I can see two "different" advisories:
Maybe that’s the reason.
markstory commentedon Jun 30, 2026
Could be. Both of those have the same ID 😵 . I'm not able to to edit the second link though, and there doesn't seem to be a way to request another review from GitHub either.
tuna-rootnet commentedon Jul 2, 2026
Is it not possible to just update the second one via the improve form, to get another review?
markstory commentedon Jul 3, 2026
I didn't know that form existed 🫠 The edit button for the 'other' advisory is in a totally different place, and has different copy.
I've opened a pull request to update the stale advisory, but with 500+ pull requests in the hopper it might be a while before anyone gets to this. github/advisory-database#8485
github-actions commentedon Nov 1, 2026
This issue is stale because it has been open for 120 days with no activity. Remove the
stalelabel or comment or this will be closed in 15 days