CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- relywp simple cloudflare turnstile WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability 5.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.8 Critical
- abpframework abp ABP Framework before 10.7.1 Authentication Bypass via External Login Provider 7.6 High
- sensiolabs symfony Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers 2.3 Low
- tinyhumansai openhuman OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer token 8.4 High
- apache software foundation ofbiz Apache OFBiz: Unauthenticated path-suffix view authorization bypass No score
- apache software foundation ofbiz Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact No score
- glpi-project glpi GLPI: MFA bypass 9.2 Critical
- traccar Traccar: Authentication bypass via path parameters exposes protected device media 7.5 High
- relywp simple cloudflare turnstile WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability 5.3 Medium
- netapp storagegrid (formerly storagegrid webscale) CVE-2026-22060 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 6.9 Medium
- netapp storagegrid (formerly storagegrid webscale) CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 9.1 Critical
- zohocorp manageengine key manager plus Two-factor authentication bypass 7.4 High
- johnson controls easyio neo ec and cw edge controller Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO... 8.7 High
- barracuda networks email security gateway (esg) Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway 9.3 Critical
- delinea secret server (on-prem) Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force 9.9 Critical
- getlago lago Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation 8.7 High
- drupal doccheck basic DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237 6.3 Medium
- silverstripe silverstripe-mfa Silverstripe MFA: Can bypass MFA during password reset flow 4.2 Medium
- fearlessgeekmedia fearlesscms FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS 9.4 Critical
- go-chi chi go-chi chi before 5.5.0 Authentication Bypass via SupressNotFound Middleware 6.3 Medium
- drupal openid connect client OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287 5.4 Medium
- drupal oauth login - oauth oidc sso OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284 4.8 Medium
- drupal captcha CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281 7.3 High
- apache software foundation kafka Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions 8.8 High
- samsung open source one A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor... 8.5 High
- watchguard fireware os Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write 9.2 Critical
- fortinet fortisandbox, fortisandbox paas +1 more An authentication bypass using an alternate path or channel vulnerability in Fortinet... 9.6 Critical
- No product listed The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass... 7.5 High
- hewlett packard enterprise (hpe) arubaos (aos) Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise 9.8 Critical
- hewlett packard enterprise (hpe) arubaos (aos) Authentication Bypass Leading to Remote Code Execution in AOS-8 10.0 Critical
- hewlett packard enterprise (hpe) arubaos (aos) Authentication Bypass Leading to Remote Code Execution in AOS-10 10.0 Critical
- bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication... 6.8 Medium
- traefik Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme 7.0 High
- drupal domain login restrict Domain Login Restrict - Moderately critical - Access bypass - SA-CONTRIB-2026-249 5.4 Medium
- opengauss-server check_hba_replication 认证与访问控制绕过 6.5 Medium
- netcore nr256cn Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix 6.9 Medium
- lenovo idea tab pro (tb373fu), idea tab/ lenovo tab k11 gen 2 (tb336fu), idea tab/ lenovo tab k11 gen 2 (tb336fu/tb336zu) +28 more +30 more A potential authentication bypass vulnerability was reported in some Lenovo tablets that could... 7.0 High
- No product listed An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an u… 9.3 Critical
- n8n-io n8n n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution 6.3 Medium
- progress moveit transfer MOVEit Transfer Secure Messaging Authentication Bypass 8.8 High
- finsys dockhand Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check 10.0 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Windows DHCP Server Security Feature Bypass Vulnerability 5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 more Windows DHCP Server Security Feature Bypass Vulnerability 5.5 Medium
- netgear rax28, rax29, rax30 +2 more Authentication Bypass Vulnerability in Certain NETGEAR RAX Series Models 6.3 Medium
- ibm planning analytics IBM Planning Analytics Local is affected by security vulnerabilities 8.8 High
- ibm planning analytics IBM Planning Analytics Local is affected by security vulnerabilities 8.8 High
- 0xjacky nginx-ui Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools 8.1 High
- digitalme eroom WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability 7.3 High
- omegathemes grocery shopping store WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability 7.1 High
- Show olderLoading…