CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- siemens ruggedcom rox mx5000, ruggedcom rox mx5000re, ruggedcom rox rx1400 +8 more +10 moreA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX...8.6 High
- siemens sinumerik 828d ppu.4, sinumerik 828d ppu.5, sinumerik 840d sl +4 more +6 moreA vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK...8.7 High
- zed-industries zedZed AI Agent Remote Code Execution8.5 High
- abb aspectUnauthenticated RCE9.3 Critical
- saad iqbal post smtpWordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability8.8 High
- ruckus smartzone, commscope ruckus network director, ruckus smartzone firmware +2 moreRuckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API...8.5 High
- brave conversion engine (pro)Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator9.8 Critical
- melapress login securityMelaPress Login Security 2.1.0 - 2.1.1 - Authentication Bypass to Privilege Escalation via get_valid_user_based_on_token Function9.8 Critical
- lg innotek camera model lnv5110rAuthentication Bypass in LG Innotek Camera8.3 High
- etq reliance cg (legacy)ETQ Reliance CG Authentication Bypass via Trailing Space RCE9.3 Critical
- gsayed786 orion login with smsOrion Login with SMS <= 1.0.5 - Authentication Bypass via Weak OTP8.1 High
- No product listedAn issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval...7.3 High
- loginpress proLoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider9.8 Critical
- scriptsbundle nokri – job board wordpress themeNokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- axis camera station, camera station pro +1 moreThe AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally...5.3 Medium
- nokia single ran airscale (flexi multiradio is not affected)Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication7.1 High
- getsentry sentrySentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation5.5 Medium
- convers lab wp smartpayWordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerability8.8 High
- ido kobelkowsky simple paymentSimple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin9.8 Critical
- drupal enterprise mfa - tfa for drupal, miniorange 2fa +1 moreEnterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-0824.8 Medium
- google chromeInsufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a...5.4 Medium
- No product listedQuest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2...8.8 High
- sony xav-ax8500, xav-ax8500 firmware +1 moreSony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability6.3 Medium
- kaon kcm3100An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this...9.3 Critical
- apache tomcatApache Tomcat: Security constraint bypass for pre/post-resources7.5 High
- amentotech workreapWorkreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'9.8 Critical
- cyberdata 011209 sip emergency intercom, 011209 sip emergency intercom firmware +1 moreCyberData 011209 SIP Emergency Intercom Authentication Bypass Using an Alternate Path or Channel9.3 Critical
- miniorange password policy managerWordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability8.8 High
- payu indiaWordPress PayU India plugin < 3.8.8 - Account Takeover vulnerability9.8 Critical
- huawei harmonyosVulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful...4.4 Medium
- uxper golo - city travel guide wordpress themeGolo <= 1.7.0 - Authentication Bypass to Account Takeover9.8 Critical
- sorich87 browse asBrowse As <= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie8.8 High
- teltonika networks rmsAccount pre-hijacking through invite misuse7.2 High
- smarsh telemessage, telemessage service +1 moreThe admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover...4.3 Medium
- mediaticus subaccounts for woocommerceWordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerability8.8 High
- versa concertoVersa Concerto Actuator Authentication Bypass Information Leak9.2 Critical
- vertiv liebert rdu101, liebert is-unity +1 moreVertiv Liebert RDU101 and UNITY Authentication Bypass Using an Alternate Path or Channel9.3 Critical
- typo3TYPO3 Has Broken Authentication in Backend MFA7.2 High
- masteriyo - lms, themegrill masteriyo +1 moreWordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability5.3 Medium
- drupal one time password, one time password project time password +1 moreOne Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-0624.8 Medium
- drupal one time password, one time password project time password +1 moreOne Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-0614.8 Medium
- mozilla thunderbirdTracking Links in Attachments Bypassed Remote Content Blocking6.5 Medium
- ivanti endpoint manager mobile, endpoint manager mobile (epmm) +1 moreAuthentication Bypass5.3 Medium
- ivanti neurons for itsm, neurons for itsm (on-prem) +1 moreAn authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024...9.8 Critical
- siemens scalance lpe9403, scalance lpe9403 firmware +1 moreA vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with...8.4 High
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab6.8 Medium
- drupal enterprise mfa - tfa for drupal, miniorange 2fa +1 moreEnterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-0567.4 High
- drupal enterprise mfa - tfa for drupal, miniorange 2fa +1 moreEnterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-0537.5 High
- peprodev ultimate profile solutionsPeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover9.8 Critical
- quarkus, red hat build of quarkus +1 moreIo.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass9.1 Critical
- Show moreLoading…