Skip to content
OpenAdvisories

Weakness (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Base Incomplete

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE-288

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2025-4427 Exploited Public exploit EPSS 100%

    Authentication Bypass

    An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

    ivanti Endpoint Manager Mobile Network devices
    KEV May 19, 2025