CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- slican cct-1668, cxs-0424, ipx +2 more +4 moreAuthentication Bypass in Slican telephone exchanges9.3 Critical
- revmakx backup and staging by wp time capsuleWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability7.5 High
- themeisle disable comments for any post types (remove comments)WordPress Disable Comments for Any Post Types (Remove comments) plugin <= 1.3.0 - Broken Authentication vulnerability7.1 High
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.0 - Broken Authentication vulnerability7.3 High
- iqonic design kivicareWordPress KiviCare plugin <= 4.3.0 - Broken Authentication vulnerability8.2 High
- frangoteam fuxaFUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection8.9 High
- No product listedAppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android...2.4 Low
- No product listedEasyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android...2.4 Low
- No product listedSailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with...2.4 Low
- themehigh stripe payment gateway for woocommerceWordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerability6.5 Medium
- microsoft entra id, entra +1 moreMicrosoft Azure Active Directory B2C Elevation of Privilege Vulnerability9.1 Critical
- zkteco ssc335-gc2063-face-0b77 solution cameraUnauthenticated Export Service in ZKTeco CCTV Cameras9.1 Critical
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an...9.8 Critical
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an...7.3 High
- markmhendrickson neotomaNeotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass6.9 Medium
- creartia internet consulting icms content managementAuthorization Bypass in ICMS Content Management by Creartia Internet Consulting9.3 Critical
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab6.5 Medium
- elecom co.,ltd. wrc-be65qsd-b, wrc-be72xsd-b, wrc-be72xsd-ba +1 more +3 moreELECOM wireless LAN access point devices do not require authentication to access some specific...9.3 Critical
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows TCP/IP Driver Security Feature Bypass Vulnerability6.5 Medium
- inkeep agentsinkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypass6.9 Medium
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes7.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes7.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass through dynamic route parameter injection8.1 High
- apnotic password pusher, pglombardo passwordpusher +1 morePassword Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication6.5 Medium
- ethyca fidesFides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection6.1 Medium
- l3montree-dev devguardDevGuard: Unauthenticated identity assertion via `X-Admin-Token` header9.3 Critical
- pickplugins user verification by pickpluginsUser Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint9.8 Critical
- elemntor temporary loginTemporary Login <= 1.0.0 - Authentication Bypass to Account Takeover9.8 Critical
- apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 moreApache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime8.2 High
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Authentication bypass using an alternate path or channel9.3 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security component9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Networking: Cookies component9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Networking: Cookies component9.8 Critical
- churchcrm crmChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout9.1 Critical
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service8.1 High
- zohocorp manageengine log360Authentication Bypass8.2 High
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex8.2 High
- visaacceptancesolutions visa acceptance solutionsVisa Acceptance Solutions <= 2.1.0 - Unauthenticated Authentication Bypass via Billing Email9.8 Critical
- openclawOpenClaw < 2026.4.8 - Command Escalation via Node Pairing Reconnect Bypass7.3 High
- No product listedmegagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition...9.8 Critical
- openairinterface oai-cn5g-amfIn OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during...9.8 Critical
- kaleris yard management solutionsAn issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login...9.8 Critical
- badlogic pi-monobadlogic pi-mono pi-mom Slack Bot slack.ts authentication bypass5.3 Medium
- better-authbetter-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache7.1 High
- apple macosThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia...7.5 High
- signalk signal k server, signalk-server +1 moresignalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity9.4 Critical
- seppmail secure email gatewayGINA State Confusion Account Takeover7.8 High
- goshsgoshs has Auth Bypass via Share Token8.1 High
- suluSulu checks fix permissions for subentities endpoints5.3 Medium
- openclawOpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass6.9 Medium
- Show moreLoading…