CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- buddyboss platform pro, platform +1 moreBuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider9.8 Critical
- liaoxuefeng itranswarpAn issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication...9.8 Critical
- inedo progetInedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through...7.3 High
@account-kit/smart-contractsnpm@account-kit/smart-contracts Allowlist Module Bypass Vulnerability6.6 Medium- apple ipados, macos, tvos +3 more +5 moreAn authentication issue was addressed with improved state management. This issue is fixed in...7.7 High
- asus routerAn improper authentication control vulnerability exists in AiCloud. This vulnerability can be...9.2 Critical
- hcl software myxalytics, hcltech dryice myxalytics +1 moreHCL MyXalytics is affected by a failure to restrict URL access vulnerability2.5 Low
- appsbd viteposWordPress Vitepos plugin <= 3.1.7 - Broken Authentication Vulnerability7.2 High
- zammadIn Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to...4.3 Medium
- cozyvision sms alert order notifications, cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recovery +1 moreSMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation9.8 Critical
- apache pinotApache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required9.8 Critical
- appsbd viteposWordPress Vitepos plugin <= 3.1.4 - Broken Authentication vulnerability8.8 High
- hossein material dashboardWordPress Material Dashboard plugin <= 1.4.5 - Privilege Escalation Vulnerability9.8 Critical
- apple ipados, visionos, ios and ipados +1 more +3 moreThis issue was addressed with additional entitlement checks. This issue is fixed in visionOS 2.4,...7.6 High
- No product listedAuthentication bypass vulnerability7.8 High
- kentico xperience, xperience cms +1 moreKentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass9.8 Critical
- kentico xperience, xperience cms +1 moreKentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass9.8 Critical
- No product listedOn 70mai Dash Cam 1S devices, by connecting directly to the dashcam's network and accessing the...7.1 High
- aonetheme service finder bookingsService Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- uxper civi, civi - job board & freelance marketplace wordpress theme +1 moreCivi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass5.6 Medium
- uxper civi, civi - job board & freelance marketplace wordpress theme +1 moreCivi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.4 - Authentication Bypass via Password Update9.8 Critical
- chimpgroup jobcareerWP JobHunt <= 7.1 - Authentication Bypass9.8 Critical
- optigo networks visual networks capture tool, visual bacnet capture tool +1 moreAuthentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool9.3 Critical
- rising technosoft cap back office applicationAuthentication Bypass Vulnerability in CAP back office application8.2 High
- amentotech workreapWorkreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- sfwebservice inwave jobs, injob +1 moreInWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation via Password Reset9.8 Critical
- dasinfomedia school management system for wordpress, school management system +1 moreSchool Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation8.8 High
- fave themes homeyHomey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check8.1 High
- drupal two-factor authentication (tfa), two-factor authentication project authentication +1 moreTwo-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-0238.1 High
- chimpstudio wp real estate managerWP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover9.8 Critical
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923...9.8 Critical
- century systems co., ltd. futurenet as-210/u4, futurenet as-250/f-ko, futurenet as-250/f-sc +10 more +12 moreAuthentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided...7.5 High
- select-themes setsail membershipSetSail Membership <= 1.0.3 - Authentication Bypass via Account Takeover9.8 Critical
- elated-themes academist membershipAcademist Membership <= 1.1.6 - Authentication Bypass via Account Takeover9.8 Critical
- edge-themes alloggio membershipAlloggio Membership <= 1.1 - Authentication Bypass via Social Login Account Takeover9.8 Critical
- ibm storage virtualizeIBM FlashSystem authentication bypass9.1 Critical
- trivision camera nc227wfMultiple vulnerabilities in Trivision Camera NC227WF7.1 High
- pluginly login me now, login me now – passwordless, magic link, otp & social login for wordpress +1 moreLogin Me Now <= 1.7.2 - Authentication Bypass8.1 High
- aldo latino privatecontentWordPress PrivateContent plugin <= 8.11.5 - Unauthenticated Account Takeover vulnerability9.8 Critical
- siber systems, inc. roboform password managerAuthentication bypass using an alternate path or channel issue exists in ”RoboForm Password...5.2 Medium
- dingtian dt-r002, dt-r008, dt-r016 +5 more +7 moreDingtian DT-R0 Series Authentication Bypass Using an Alternate Path or Channel9.3 Critical
- netapp instaclustr fork of stratio's cassandra-lucene-index pluginCassandra-Lucene-Index allows bypass of Cassandra RBAC8.8 High
- chimpstudio wp directorybox managerWP Directorybox Manager <= 2.5 - Authentication Bypass9.8 Critical
- fortinet fortios, fortiproxy, fortios and fortiproxy +2 moreAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting...8.1 High
- chimpstudio wp foodbakeryWP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_request9.8 Critical
- chimpstudio wp directorybox managerWP Directorybox Manager <= 2.5 - Authentication Bypass9.8 Critical
- nextendweb nextend social login proNextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth provider9.8 Critical
- elber cleber/3 broadcast multi-purpose platform, ese dvb-s/s2 satellite receiver, reble610 m/odu xpic ip-asi-sdh +2 more +4 moreElber Communications Equipment Authentication Bypass Using an Alternate Path or Channel9.3 Critical
- mitmproxyMitmweb API Authentication Bypass Using Proxy Server8.2 High
- bigantsoft bigant serverBigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE9.8 Critical
- Show moreLoading…