CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- typo3 oidcTYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)4.2 Medium
- scriptsbundle adforestAdForest <= 5.1.8 - Authentication Bypass9.8 Critical
- jetbrains hubIn JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication...6.7 Medium
- ivanti avalanchePath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker...7.3 High
- ivanti avalanchePath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker...7.3 High
- fortinet fortios, fortiproxy, fortios and fortiproxy +2 moreAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting...9.6 Critical
- netgear dgn1000, dgn1000 firmware +1 moreNETGEAR DGN setup.cgi OS Command Injection9.8 Critical
- themescoder tc ecommerce – create android & ios apps for woocommerceThemes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation9.8 Critical
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability9.8 Critical
- ibm iIBM i authentication bypass4.3 Medium
- scriptsbundle adforestAdForest <= 5.1.6 - Authentication Bypass9.8 Critical
- wofficeio wofficeWordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability9.8 Critical
- wovax idx, wovax, llc. wovax idx +1 moreWordPress Wovax IDX plugin <= 1.2.2 - Account Takeover vulnerability8.8 High
- projectopiaWordPress Projectopia plugin <= 5.1.7 - Account Takeover vulnerability8.8 High
- extremeidea vbsso-liteWordPress vBSSO-lite plugin <= 1.4.3 - Account Takeover vulnerability9.8 Critical
- codexpert, inc coschool lmsWordPress CoSchool LMS plugin <= 1.4.3 - Account Takeover vulnerability9.8 Critical
- fluxbuilder listapp mobile managerWordPress ListApp Mobile Manager plugin <= 1.7.7 - Account Takeover vulnerability9.8 Critical
- appgenix infotech firebase otp authenticationWordPress Firebase OTP Authentication plugin <= 1.0.1 - Account Takeover vulnerability9.8 Critical
- ivanti cloud services application, cloud services appliance +1 moreAn authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote...10.0 Critical
- elabftweLabFTW MFA bypass5.4 Medium
- india-web-developer login with otp, wordpress login with otp plugin +1 moreLogin With OTP <= 1.4.2 - Authentication Bypass via Weak OTP8.1 High
- ibm cognos controllerIBM Cognos Controller authentication bypass4.3 Medium
- b&r industrial automation gmbh mapp cockpit, mapp motion, mapp services +2 more +4 moreAuthentication bypass flaw in several mapp components8.4 High
- billion electric m100, m120n, m150 +1 more +3 moreBillion Electric router - Authentication Bypass7.5 High
- 101gen wawpWordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability9.8 Critical
- eyecix jobsearch wp job boardWP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation9.8 Critical
- sharp corporation multiple mfps (multifunction printers)"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. ...9.1 Critical
- claudeschlesser social login, oneall social login oa-social-login +1 moreSocial Login <= 5.9.0 - Authentication Bypass via Disqus OAuth provider9.8 Critical
- cmorillas1 external database based actionsExternal Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass7.5 High
- really-simple-plugins really simple security, really simple plugins simple security pro, simple security pro multisite +1 more +3 moreReally Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass9.8 Critical
- fortinet forticlient, forticlientwindows +1 moreA authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version...7.4 High
- icdsoft multimanager wp – manage all your wordpress sites easily, multimanager wp, multimanager wp manage all your word press sites easily +2 moreMultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation9.8 Critical
- mobisoft974 relais 2faRelais 2FA <= 1.0 - Authentication Bypass9.8 Critical
- ce21 suite, ce21com ce21 suite, ce21 ce21-suite +2 moreCE21 Suite <= 2.2.0 - Authentication Bypass9.8 Critical
- ericsson codecheckercodechecker vulnerable to authentication bypass when using specifically crafted URLs10.0 Critical
- deryck user toolkitWordPress User Toolkit plugin <= 1.2.3 - Account Takeover vulnerability9.8 Critical
- odude crypto, crypto tool +1 moreCrypto <= 2.18 - Authentication Bypass via log_in9.8 Critical
- odude crypto, crypto tool +1 moreCrypto <= 2.19 - Authentication Bypass via register9.8 Critical
- erudika scooldSemicolon Path Injection on API /api;/config8.7 High
- priyabrata sarkar token loginWordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability8.8 High
- stacks mobile app builder, stacksmarket stacks mobile app builder +1 moreWordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability9.8 Critical
- acnoo flutter apiWordPress Acnoo Flutter API plugin <= 1.0.5 - Account Takeover vulnerability9.8 Critical
- acnoo maanstore apiWordPress MaanStore API plugin <= 1.0.1 - Account Takeover vulnerability9.8 Critical
- realty workstation workstation, realtyworkstation realty workstation +1 moreWordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability9.8 Critical
- sun.net ehrd ctmsSunnet eHRD CTMS - Authentication Bypass7.5 High
- roxnor wp social login and register social counterWp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider9.8 Critical
- hocwp extensions, skylarkcob extensions by hocwp team +1 moreExtensions by HocWP Team <= 0.2.3.2 - Authentication Bypass9.8 Critical
- watchtowerhq watchtower, watchtowerhq +1 moreWatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check9.8 Critical
- deryck user toolkitUser Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass8.8 High
- jurre de klijn wux blog editorWux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator9.8 Critical
- Show moreLoading…