diff --git a/docs/changelogs/v4.7.7.md b/docs/changelogs/v4.7.7.md
index a2195cc39a8d..e5fa4c2ba416 100644
--- a/docs/changelogs/v4.7.7.md
+++ b/docs/changelogs/v4.7.7.md
@@ -14,4 +14,6 @@ Release Date: Unreleased
 
 ## Bugs Fixed
 
+- **Security:** Fixed a bug where `Security::__construct()` threw a `TypeError` when the CSRF cookie was an array, causing an HTTP 500 response for affected requests.
+
 See the repo's [CHANGELOG.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md) for a complete list of bugs fixed.
diff --git a/system/Security/Security.php b/system/Security/Security.php
index 44e96be29016..89abc75a8e68 100644
--- a/system/Security/Security.php
+++ b/system/Security/Security.php
@@ -206,7 +206,8 @@ public function __construct(SecurityConfig $config)
         }
 
         $this->request      = service('request');
-        $this->hashInCookie = $this->request->getCookie($this->cookieName);
+        $hashInCookie       = $this->request->getCookie($this->cookieName);
+        $this->hashInCookie = is_string($hashInCookie) ? $hashInCookie : null;
 
         $this->restoreHash();
         if ($this->hash === null) {
diff --git a/tests/system/Security/SecurityTest.php b/tests/system/Security/SecurityTest.php
index f4eb8b88a830..5c8c98a9e50a 100644
--- a/tests/system/Security/SecurityTest.php
+++ b/tests/system/Security/SecurityTest.php
@@ -464,4 +464,17 @@ public static function provideGetPostedTokenReturnsNullForInvalidInputs(): itera
 
         yield 'invalid_form_data' => [self::createIncomingRequest()->setBody('csrf_test_name[]=invalid')];
     }
+
+    public function testConstructorHandlesArrayCookieWithoutTypeError(): void
+    {
+        service('superglobals')
+            ->setServer('REQUEST_METHOD', 'GET')
+            ->setCookie('csrf_cookie_name', ['malicious' => 'array']);
+
+        $config   = new SecurityConfig();
+        $security = new Security($config);
+
+        $this->assertIsString($security->getHash());
+        $this->assertSame(32, strlen($security->getHash()));
+    }
 }