Skip to content
OpenAdvisories

Weakness (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Base Incomplete

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE-288

All Critical High Medium Low Exploited only Public exploit

44 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-2982 Public exploit Scanner template EPSS 46%

    WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass

    The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login …

    cyberlord92 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Critical 9.8
    CVE-2023-2986 Public exploit EPSS 43%

    Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass

    The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the p…

    Tyche Softwares Abandoned Cart Lite for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2023-2732 Public exploit Scanner template EPSS 67%

    MStore API <= 3.9.2 - Authentication Bypass

    The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it p…

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS
  • Critical 9.8
    CVE-2020-10148 Exploited Public exploit Scanner template EPSS 92%

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …

    SolarWinds Orion Platform
    KEV Nov 3, 2021