Weakness (CWE)
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it (1 mitigation)
-
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Source: MITRE CWE-288
771 results · Feed
-
High 7.3
WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.
-
High 8.1
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs…
-
Medium 6.5
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0, Steeltoe.Security.Authorization.Certificate deployments using AddOrgAndSpacePolicies() and UseCertificateAuthorization…
-
Critical 9.8
WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.
-
High 7.7
Kong API Gateway Enterprise: SAML Authentication bypass
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assert…
-
Critical 9.8
Authentication Bypass in _account_log
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
-
High 8.2
PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any no…
-
High 7.2
goproxy through 15.3 Authentication Bypass via CONNECT
goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy witho…
-
High 8.7
Authentication bypass using an alternate path or channel and Improper validation of syntactic correctness of input vuln…
-
Medium 6.3
[UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks
Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and rece…
-
High 7.3
WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3.
-
Medium 6.5
WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.
-
High 7.1
WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability
Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.
-
High 8.3CVE-2026-88861 Public exploit
Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization
Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when…
-
Medium 6.0
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who h…
-
High 7.8
In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a…
-
High 8.1
An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated at…
-
High 8.7
CommServe Information Disclosure
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 8.8
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the we…
-
High 7.5
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found route…
-
Critical 9.1
Microsoft Entra ID Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
-
High 7.4
WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability
Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.
-
Medium 4.1
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
-
Low 3.7
CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.
-
High 7.4
WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.
-
High 8.1
Gophish Account Lockout and Forced Password Change Bypassable via API Key
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or pas…
-
Critical 9.8
Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel
Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with pr…
-
Critical 9.3
A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.
-
Medium 5.5
Authentication Bypass Using an Alternate Path or Channel in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal o…
-
High 8.1
Unauthorized credential switching
In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedi…
-
Critical 9.8
Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.
-
High 8.6
SMS Password Authorization Bypass via Failed Attempt Counter
The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS pa…
-
High 7.3
WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.
-
Critical 9.8
WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
-
High 7.6
WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
-
Critical 9.3
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
KEV Sep 9, 2026 -
High 8.8
4gaBoards: Pre-Account Takeover via SSO Email Linkage
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO…
-
High 7.1
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component whil…
-
Critical 9.1
Authentication bypass in Integrated Publishing Toolkit
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
-
Medium 6.5
WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.