Skip to content
OpenAdvisories

Weakness (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Base Incomplete

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE-288

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-18577 Exploited Public exploit EPSS 15%

    Incomplete patch leads to administrative account takeover

    An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1

    N-able N-central
    KEV Aug 3, 2026
  • High 8.2
    CVE-2026-18556 Exploited Public exploit

    Unauthenticated administrative account takeover

    Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

    N-able N-central
    KEV Aug 4, 2026
  • High 8.1
    CVE-2025-24472 Exploited · Ransomware Public exploit

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0…

    Fortinet FortiOS FortiProxy Network devices
    KEV Mar 18, 2025