Weakness (CWE)
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it (1 mitigation)
-
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Source: MITRE CWE-288
281 results · Clear filters · Feed
-
Critical 9.8
Windows Kerberos Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Multiple Vulnerabilities in IBM API Connect
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.
-
Critical 9.8CVE-2026-84473 Public exploit
CVE-2026-84473
Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentica…
-
Critical 9.2
GLPI: MFA bypass
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in vers…
-
Critical 9.1
CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)
StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.
-
Critical 9.3
Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modifi…
KEV Nov 10, 2026 -
Critical 9.9
Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
-
Critical 9.4
FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or ad…
-
Critical 9.2
Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access…
-
Critical 9.6
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6,…
-
Critical 9.8
Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compro…
-
Critical 10.0
Authentication Bypass Leading to Remote Code Execution in AOS-8
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrar…
-
Critical 10.0
Authentication Bypass Leading to Remote Code Execution in AOS-10
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitati…
-
Critical 9.3
An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path c…
-
Critical 10.0
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated call…
-
Critical 9.8
TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session …
-
Critical 9.2
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login…
-
Critical 9.3
FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability
A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing v…
-
Critical 9.2
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occ…
-
Critical 9.8
WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
-
Critical 9.8
Authentication Bypass in _account_log
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
-
Critical 9.1
Microsoft Entra ID Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel
Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with pr…
-
Critical 9.3
A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.
-
Critical 9.8
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
-
Critical 9.8
WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
-
Critical 9.3
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
KEV Sep 9, 2026 -
Critical 9.1
Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
-
Critical 9.1
WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.
-
Critical 9.8
Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to re…
-
Critical 9.1CVE-2026-75045 Public exploit
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download datab…
-
Critical 9.8
WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
-
Critical 9.8
WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.
-
Critical 9.8
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an o…
-
Critical 9.5CVE-2026-58073 Public exploit
A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent a…
-
Critical 9.3CVE-2026-18574 Public exploit
Authentication Bypass in Check Point Security Management Server
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the S…
-
Critical 10.0
Authentication bypass on WaptServer
A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account.
-
Critical 9.2
Authentication and Authorization Bypass in Coverity Connect
A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authoriz…
-
Critical 9.8
SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. Thi…
-
Critical 9.4
Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0
Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.