From 69165254aca22ecc6d20e5ab8c4dbae162a5443f Mon Sep 17 00:00:00 2001
From: Bogdan <matolq@gmail.com>
Date: Wed, 4 Nov 2026 20:50:35 +0100
Subject: [PATCH 1/2] fix(Security): prevent TypeError when CSRF cookie is an
 array (DoS)

---
 system/Security/Security.php           |  3 ++-
 tests/system/Security/SecurityTest.php | 13 +++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/system/Security/Security.php b/system/Security/Security.php
index 44e96be29016..89abc75a8e68 100644
--- a/system/Security/Security.php
+++ b/system/Security/Security.php
@@ -206,7 +206,8 @@ public function __construct(SecurityConfig $config)
         }
 
         $this->request      = service('request');
-        $this->hashInCookie = $this->request->getCookie($this->cookieName);
+        $hashInCookie       = $this->request->getCookie($this->cookieName);
+        $this->hashInCookie = is_string($hashInCookie) ? $hashInCookie : null;
 
         $this->restoreHash();
         if ($this->hash === null) {
diff --git a/tests/system/Security/SecurityTest.php b/tests/system/Security/SecurityTest.php
index f4eb8b88a830..5c8c98a9e50a 100644
--- a/tests/system/Security/SecurityTest.php
+++ b/tests/system/Security/SecurityTest.php
@@ -464,4 +464,17 @@ public static function provideGetPostedTokenReturnsNullForInvalidInputs(): itera
 
         yield 'invalid_form_data' => [self::createIncomingRequest()->setBody('csrf_test_name[]=invalid')];
     }
+
+    public function testConstructorHandlesArrayCookieWithoutTypeError(): void
+    {
+        service('superglobals')
+            ->setServer('REQUEST_METHOD', 'GET')
+            ->setCookie('csrf_cookie_name', ['malicious' => 'array']);
+
+        $config   = new SecurityConfig();
+        $security = new Security($config);
+
+        $this->assertIsString($security->getHash());
+        $this->assertSame(32, strlen($security->getHash()));
+    }
 }

From ce6203563a87150be926afb34c098143c9c24e4d Mon Sep 17 00:00:00 2001
From: Bogdan <matolq@gmail.com>
Date: Wed, 4 Nov 2026 21:32:37 +0100
Subject: [PATCH 2/2] docs: add changelog entry for CSRF cookie array fix

---
 docs/changelogs/v4.7.7.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/changelogs/v4.7.7.md b/docs/changelogs/v4.7.7.md
index a2195cc39a8d..e5fa4c2ba416 100644
--- a/docs/changelogs/v4.7.7.md
+++ b/docs/changelogs/v4.7.7.md
@@ -14,4 +14,6 @@ Release Date: Unreleased
 
 ## Bugs Fixed
 
+- **Security:** Fixed a bug where `Security::__construct()` threw a `TypeError` when the CSRF cookie was an array, causing an HTTP 500 response for affected requests.
+
 See the repo's [CHANGELOG.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md) for a complete list of bugs fixed.