CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- frangoteam fuxaFUXA has JWT Authentication Bypass via HTTP Referer header spoofing9.8 Critical
- case-themes bookedWordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability6.7 Medium
- ahachat messenger marketing, unknown ahachat messenger marketing +1 moreWordPress AhaChat Messenger Marketing plugin <= 1.1 - Broken Authentication vulnerability6.5 Medium
- kamleshyadav miraculous elementorWordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerability8.8 High
- hewlett packard enterprise (hpe) hpe aruba networking private 5g core, hpe aruba networking private 5g core +1 moreUnauthenticated Improper Access Control in management API allows unauthorized service disruption6.5 Medium
- hewlett packard enterprise (hpe) hpe aruba networking private 5g core, hpe aruba networking private 5g core +1 moreUnauthenticated Authentication Bypass in application API allows unauthorized administrative account creation8.8 High
- micca auto electronics co., ltd. car alarm system ke700Micca KE700 Acceptance of previously used rolling codes8.4 High
- uni-yaz flexcity, universal software inc. flexcity/kiosk +1 moreAdmin Account Takeover in Universal Sotware's FlexCity/Kiosk8.8 High
- diveshlunker bloodxBloodX 1.0 - Authentication Bypass6.9 Medium
- ivanti endpoint manager, endpoint manager (epm) +1 moreAn authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote...8.6 High
- berabuddies agentflowFlowring｜Agentflow - Missing Authenticaton9.3 Critical
- berabuddies agentflowFlowring｜Agentflow - Authentication Bypass9.3 Critical
- budda login disableLogin Disable - Less critical - Access bypass - SA-CONTRIB-2026-0084.3 Medium
- juniper networks session smart conductor, session smart router, wan assurance managed router +2 moreSession Smart Router, Session Smart Conductor, WAN Assurance Router: API Authentication Bypass vulnerability9.3 Critical
- fortinet fortianalyzer, fortimanager, fortinac-f +6 more +8 moreAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability...9.4 Critical
- No product listedAn issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user...9.8 Critical
- amentotech workreap coreWordPress Workreap Core plugin <= 3.4.1 - Broken Authentication vulnerability9.8 Critical
- smartertools smartermailSmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API9.3 Critical
- fastify fastify-express@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)8.4 High
- fmeaddons registration & login with mobile phone number for woocommerceRegistration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass9.8 Critical
- drupal microsoft entra id sso loginMicrosoft Entra ID SSO Login - Critical - Access bypass - SA-CONTRIB-2026-0056.5 Medium
- tycc tongyu ax1800 firmwareAn authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0...8.8 High
- apple ipados, ios and ipados, iphone os +2 moreA logic issue was addressed with improved validation. This issue is fixed in iOS 26.2 and iPadOS...4.3 Medium
- tim-solutions tim flowIn TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists...5.4 Medium
- No product listedA vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an...8.2 High
- arraytics timeticsWordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerability8.8 High
- ricetheme felan frameworkWordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability9.8 Critical
- plat'home co.,ltd. openblocks idm rx1 (fw5.0.x), openblocks iot dx1 (fw5.0.x), openblocks iot ex/bx models (fw5.0.x) +3 more +5 moreAuthentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may...8.7 High
- petlibrio smart pet feeder platform, petlibro +1 morePetlibro Smart Pet Feeder Platform through 1.7.31 Audio Information Disclosure via API endpoint6.9 Medium
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller Authentication Bypass10.0 Critical
- signalk signal k server, signalk-server +1 moreSignal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling9.1 Critical
- delta electronics dvp-12se11t, deltaww dvp-12se11t firmware +1 moreDVP-12SE11T - Password Protection Bypass9.1 Critical
- mobile builder builderWordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerability9.8 Critical
- amentotech tuturnWordPress Tuturn plugin < 3.6 - Broken Authentication vulnerability9.8 Critical
- libreofficeTCC Bypass via Inherited Permissions in Bundled Interpreter0.9 Low
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab6.8 Medium
- filamentphp filamentFilament's multi-factor authentication (app) recovery codes can be used multiple times8.1 High
- apache http serverApache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo5.4 Medium
- sunbird dcim dctrack, iq +1 moreSunbird DCIM dcTrack and Power IQ Authentication Bypass Using an Alternate Path or Channel7.4 High
- drupal disable login pageDisable Login Page - Critical - Access bypass - SA-CONTRIB-2025-1244.2 Medium
- cksource ckeditor 5 premium featuresCKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-1185.3 Medium
- elated themes findall membershipFindAll Membership <= 1.0.4 - Authentication Bypass via Social Login9.8 Critical
- abb ability edgeniusABB Ability Edgenius Authentication Bypass9.4 Critical
- itel id mux firmwareThe Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper...9.8 Critical
- apollographql federation@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields7.5 High
- asus dsl-ac51, dsl-ac51 firmware, dsl-ac750 +3 more +5 moreAn authentication bypass vulnerability has been identified in certain DSL series routers, may...9.3 Critical
- centralsquare community developmentAn Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to...9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component8.1 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Core & HTML component6.1 Medium
- elated-themes search & goWordPress Search & Go theme <= 2.7 - Broken Authentication vulnerability9.8 Critical
- Show moreLoading…