Weakness (CWE)
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it (1 mitigation)
-
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Source: MITRE CWE-288
772 results · Feed
-
Medium 6.5
WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart Recovery for WooCommerce woo-abandoned-cart-recovery allows Authentication Abuse.This issue affects Abandoned Cart Recovery for WooCommerce: from n/a through <…
-
Critical 9.8
WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from…
-
Medium 6.8
A protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical access to completely bypas…
-
High 8.8
MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit …
-
Critical 9.1
SFTP Server Authentication Weakness
An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlyi…
-
Low 3.5
Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications …
-
Medium 6.9
Blocked users can create and edit WikiLambda objects
Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.
-
High 7.4
AS228T - Authentication Bypass Vulnerability
AS228T with Authentication Bypass Vulnerability
-
Medium 5.3
In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote inform…
-
Medium 5.3
In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of servic…
-
Critical 9.1
Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests
Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via …
-
Critical 10.0
Kestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it…
-
High 7.5
WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
-
Critical 9.3
Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAu…
-
Critical 9.3
FOSSBilling: Authentication bypass allows unauthenticated administrator creation
FOSSBilling is a free, open-source billing and client management system. Versions 0.7.2 and prior expose a guest API endpoint, /api/guest/staff/create, intended for initial administrator bootstrap. Due to a flawed admin-existence check, the endpoint remains u…
-
High 7.8
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcemen…
-
High 7.8
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router T…
-
High 7.8
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization.…
-
High 8.1
Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by …
-
High 7.5
WordPress Time Capsule Plugin 1.21.16 Authentication Bypass
WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obt…
-
Critical 9.8
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass
WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-aj…
-
High 8.2
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (`Management:E…
-
Medium 6.5
WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.
-
High 7.6
WordPress Melhor Envio plugin <= 2.16.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
-
Critical 9.8
WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.
-
Medium 6.5
WordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.
-
High 8.8
WordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
-
High 8.1
WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic booknetic allows Authentication Abuse.This issue affects Booknetic: from n/a before 5.10.3.
-
High 8.7
syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent
syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid credentials for a user account can bypass the two-factor authentication flow by sending HTTP requests w…
-
Critical 9.8
WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
-
High 8.1
WordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.
-
High 7.5
WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.
-
High 8.1
WordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.
-
Medium 6.5
WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability
Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.
-
Medium 5.8
WordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.
-
Medium 6.5
WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.
-
High 7.1
WordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability
Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.
-
High 7.5
WordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.
-
High 7.1
WordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.
-
High 8.8
WordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7.