Skip to content
OpenAdvisories

Weakness (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Base Incomplete

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE-288

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2021-43718 Public exploit

    An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malic…

  • Medium 5.3
    CVE-2025-4427 Exploited Public exploit EPSS 100%

    Authentication Bypass

    An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

    ivanti Endpoint Manager Mobile Network devices
    KEV May 19, 2025
  • Medium 4.3
    CVE-2024-51464 Public exploit

    IBM i authentication bypass

    IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to remotely perform operations that the user is not allowed to perfor…

    IBM i