Weakness (CWE)
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it (1 mitigation)
-
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Source: MITRE CWE-288
272 results · Clear filters · Feed
-
High 8.4
OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivale…
-
High 7.5CVE-2026-73577 Public exploit
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., …
-
High 7.5
Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIE…
-
High 7.5
Traccar: Authentication bypass via path parameters exposes protected device media
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who k…
-
High 7.4
Two-factor authentication bypass
ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.
-
High 8.7
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Co…
-
High 8.8
Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept wi…
-
High 7.3
CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
-
High 8.8
Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring…
-
High 8.5
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disa…
-
High 7.5
The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security control…
-
High 8.7
Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 buil…
-
High 8.8
MOVEit Transfer Secure Messaging Authentication Bypass
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
-
High 8.8
Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vul…
-
High 8.8
IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.
-
High 8.8
IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
-
High 8.1
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_mo…
-
High 7.3
WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.
-
High 7.1
WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
-
High 7.7
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.…
-
High 8.8
WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability
Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.
-
High 7.5
WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Password Recovery Exploitation.This issue affects Graphina – Charts and Graphs For …
-
High 7.4
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/platform-fastify` | | Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` | | Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) | ### Summary On the Fastify …
-
High 8.6
Snipe-IT: 2FA bypass via the API token flow
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTw…
-
High 7.3
WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.
-
High 8.1
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs…
-
High 7.7
Kong API Gateway Enterprise: SAML Authentication bypass
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assert…
-
High 8.2
PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any no…
-
High 7.2
goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy witho…
-
High 8.7
Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vuln…
-
High 7.3
WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3.
-
High 7.1
WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
-
High 8.3CVE-2026-88861 Public exploit
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when…
-
High 7.8
In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a…
-
High 8.1
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated at…
-
High 8.7
CommServe Information Disclosure
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 8.8
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the we…
-
High 7.5
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found route…
-
High 7.4
WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability
Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
-
High 7.4
WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.