[GHSA-hhpq-7wg4-36jm] CakePHP Authentication: Open redirect weakness via backslash bypass

[markstory]

Updates

• Affected products
• Description

Comments
Updating version range as 2.x was also vulnerable and has been patched now.

[github]

Hi there @markstory! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Updates the OSV advisory record for GHSA-hhpq-7wg4-36jm (CakePHP Authentication open redirect via backslash bypass) to reflect expanded affected versions and updated patch information.

Changes:

• Updated advisory metadata (modified) and patch guidance in details to include the 2.11.1 fix.
• Refined the 3.x affected range to start at 3.0.0 instead of 0.
• Added a new affected range intended to cover the 2.x line (fixed in 2.11.1).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.