CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- apollographql routerApollo Router Core: Access Control Bypass on Polymorphic Types7.5 High
- elspec-ltd g5dfr firmwareOn Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the...6.8 Medium
- drupal email tfa, email tfa project tfa +1 moreEmail TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-1155.4 Medium
- apple ipados, macos, tvos +4 more +6 moreA permissions issue was addressed with additional restrictions. This issue is fixed in watchOS 26...7.5 High
- apple ipados, ios and ipados, iphone os +2 moreThe issue was addressed by adding additional logic. This issue is fixed in iOS 26.1 and iPadOS 26...4.6 Medium
- unknown noo jobmonsterJobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass9.8 Critical
- google chromePolicy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who...6.5 Medium
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an...6.5 Medium
- drupal simple oauth (oauth2) & openid connect, simple oauth project oauth +1 moreSimple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-1147.5 High
- asseco poland s.a. mmedicaUnauthorized database access in Asseco mMedica9.3 Critical
- hashicorp vault, vault enterprise +1 moreVault AWS auth method bypass due to AWS client cache8.1 High
- iulia cazan emails catch allWordPress Emails Catch All plugin <= 3.5.3 - Broken Authentication vulnerability8.8 High
- quantumcloud simple link directoryWordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerability9.8 Critical
- raisecomm rax701-gc-wp-01 p200r002c52, rax701-gc-wp-01 p200r002c53 +1 moreAuthentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC Series9.3 Critical
- zoom roomsZoom Rooms Clients - Authentication Bypass5.3 Medium
- victornavarro ownid passwordless loginOwnID Passwordless Login <= 1.3.4 - Authentication Bypass9.8 Critical
- gsayed786 orion sms otp verification.Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover9.8 Critical
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +25 more +27 moreWindows BitLocker Security Feature Bypass Vulnerability6.1 Medium
- elated-themes search & go - directory wordpress themeSearch & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover9.8 Critical
- tesla telematics control unit (tcu)Tesla Telematics Control Unit (TCU) < v2025.14 Authentication Bypass8.6 High
- sick baggage analytics, logistic diagnostic analytics, package analytics +1 more +3 moreThe credentials of the users stored in the system's local database can be used for the log in,...4.3 Medium
- aiven-open karapaceKarapace is vulnerable to Authentication Bypass8.6 High
- talemy spirit frameworkSpirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation9.8 Critical
- raise3d pro2 seriesRaise3D Pro2 Series 3D Printers Authentication Bypass Using an Alternate Path or Channel8.6 High
- fortinet fortios, fortiproxy, siemens ruggedcom ape1808 +2 moreAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7...6.3 Medium
- apache kylinApache Kylin: Authentication bypass7.5 High
- lg innotek camera model lnd7210, camera model lnv7210r +1 moreAuthentication Bypass in LG Innotek Camera8.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function8.2 High
- aonetheme service finder sms systemService Finder SMS System <= 2.0.0 - Authentication Bypass8.1 High
- nokia cbis,ncsAuthentication Bypass8.8 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Web Compatibility: Tooling component5.4 Medium
- scriptsbundle adforestAdForest <= 6.0.9 - Authentication Bypass to Admin9.8 Critical
- elastic endpoint, sangoma freepbx +1 moreFreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE10.0 Critical
- nootheme jobmonsterWordPress Jobmonster Theme <= 4.7.9 - Broken Authentication Vulnerability9.8 Critical
- uxper goloWordPress Golo Theme <= 1.7.0 - Broken Authentication Vulnerability9.8 Critical
- arcserve udp, unified data protection (udp) +1 moreArcserve UDP < 10.2 Authentication Bypass7.7 High
- authenticator login project login, drupal authenticator login +1 moreAuthenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-0988.8 High
- bravis-themes bravis userBravis User <= 1.0.1 - Authentication Bypass to Account Takeover8.1 High
- case themes theme user, case-themes case theme user +1 moreCase Theme User <= 1.0.3 - Authentication Bypass via Social Login9.8 Critical
- simplercheckout simpler checkoutSimpler Checkout 0.7.0 - 1.1.9 - Authentication Bypass9.8 Critical
- reolinkAn issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass...5.4 Medium
- tenda ac6 v5.0, ac6 firmware +1 moreAn information disclosure vulnerability exists in the /goform/getproductInfo functionality of...7.5 High
- tenda ac6 v5.0, ac6 firmware +1 moreAn authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda...9.8 Critical
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability9.8 Critical
- winterchens my-siteThere is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025...9.8 Critical
- No product listedAn issue in the default configuration of the password reset function in LogicData eCommerce...5.3 Medium
- liferay dxp, portal +1 moreLiferay Portal Login Bypass Vulnerability2.0 Low
- authenticator login project login, drupal authenticator login +1 moreAuthenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-0969.8 Critical
- totolink a7000r firmwareIn TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a...9.8 Critical
- fortinet fortios, fortipam, fortiproxy +1 more +3 moreAn authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet...7.9 High
- Show moreLoading…