Skip to content
OpenAdvisories

Weakness (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Base Incomplete

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE-288

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.0
    CVE-2025-3639 Public exploit

    Liferay Portal Login Bypass Vulnerability

    Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 and 7.3 GA through update 36 all…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven