CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- miniorange security software pvt ltd. oauth single sign on - sso (oauth client)WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability9.8 Critical
- No product listedA protection mechanism failure in the Code 27 Companion Hub allows an attacker with physical...6.8 Medium
- microrealestateMicroRealEstate allows adversaries to bypass authentication due to a lack of token state...8.8 High
- ciena 6500 s-series, 6500 t-series, cpl +1 more +3 moreSFTP Server Authentication Weakness9.1 Critical
- wso2 api manager, identity server +1 moreCross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure3.5 Low
- mediawiki, the wikimedia foundation mediawiki - wikilambda extension +1 moreBlocked users can create and edit WikiLambda objects6.9 Medium
- deltaww as228tAS228T - Authentication Bypass Vulnerability7.4 High
- mediatek, inc. mediatek chipsetIn Modem, there is a possible information disclosure due to improper input validation. This could...5.3 Medium
- mediatek, inc. mediatek chipsetIn Modem, there is a possible system crash due to improper input validation. This could lead to...5.3 Medium
- threemammals ocelotOcelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests9.3 Critical
- kestraKestra: Unauthenticated RCE via /configs path-suffix auth-filter bypass10.0 Critical
- corvuspay woocommerce payment gatewayWordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability7.5 High
- rocket.chatRocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuth9.3 Critical
- fossbillingFOSSBilling: Authentication bypass allows unauthenticated administrator creation9.3 Critical
- cap-go capgoCapgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane8.6 High
- wptimecapsule time capsule pluginWordPress Time Capsule Plugin 1.21.16 Authentication Bypass8.7 High
- brainstorm force ultimate addons for beaver builderWordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass9.3 Critical
- mervinpraison praisonaiPraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation8.2 High
- steeltoeoss steeltoe.management.endpoint, steeltoe.management.endpointcore +1 moreSteeltoe vulnerable to management-port isolation bypass via spoofed Host header8.2 High
- fluxbuilder mstore api, mstore api +1 moreWordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability6.5 Medium
- melhorenvio melhor envioWordPress Melhor Envio plugin <= 2.16.3 - Broken Authentication vulnerability7.6 High
- tomdever wpforo forumWordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability9.8 Critical
- opmc woocommerce dropshippingWordPress WooCommerce Dropshipping plugin <= 5.2.4 - Broken Authentication vulnerability6.5 Medium
- ideabox creations powerpack pro for elementorWordPress PowerPack Pro for Elementor plugin < v2.13.0 - Broken Authentication vulnerability8.8 High
- bookneticWordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability8.1 High
- traefik, red hat openshift dev spaces 3.30 +1 moreTraefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts7.8 High
- traefik, red hat openshift dev spaces 3.30 +1 moreTraefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass7.8 High
- syracom ag secure login (2fa) for confluence, secure login (2fa) for bitbucket, secure login (2fa) for jira +2 moresyracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent8.7 High
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability9.8 Critical
- really simple plugins simple sslWordPress Really Simple SSL plugin <= 9.5.10 - Broken Authentication vulnerability8.1 High
- omnisend email marketing for woocommerce by omnisendWordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability7.5 High
- xserver cloudsecure wp securityWordPress CloudSecure WP Security plugin <= 1.4.7 - Broken Authentication vulnerability8.1 High
- themeisle wp full stripe freeWordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability6.5 Medium
- relywp simple cloudflare turnstileWordPress Simple Cloudflare Turnstile plugin <= 1.38.0 - Broken Authentication vulnerability5.8 Medium
- veronalabs wp smsWordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability6.5 Medium
- ruben garcia automatorwpWordPress AutomatorWP plugin <= 5.6.7 - Broken Authentication vulnerability7.1 High
- reviewxWordPress ReviewX plugin <= 2.3.6 - Broken Authentication vulnerability7.5 High
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.7.3 - Broken Authentication vulnerability7.1 High
- wp engine faust.jsWordPress Faust.js plugin <= 1.8.7 - Broken Authentication vulnerability8.8 High
- traefik, red hat openshift dev spaces 3.30 +1 moreTraefik StripPrefix Route-Level Auth Bypass via Path Normalization7.8 High
- ivanti sentry, standalone sentry +1 moreAn Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and...9.9 Critical
- webfactory advanced google recaptchaWP Captcha PRO <= 5.38 - Authenticated (Subscriber+) Authentication Bypass via Temporary Login Link8.8 High
- No product listedAn issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to...6.8 Medium
- liquid web / stellarwp bookitWordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability7.5 High
- wp swings wallet system for woocommerceWordPress Wallet System for WooCommerce plugin <= 2.7.5 - Broken Authentication vulnerability7.1 High
- @clerk nuxt, nuxt nuxt\/nitro-server +1 moreNuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`6.3 Medium
- waterfall wf-500, waterfall-security wf-500 firmware +1 moreNozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or...9.3 Critical
- tp-link archer c64 firmware, tp-link systems inc. archer c64 v1.0 +1 moreImproper Authentication Rate Limiting on TP-Link's Archer C648.7 High
- view concept kidsviewAuthentication Bypass in Kidsview5.3 Medium
- slican cct-1668, cxs-0424, ipl-256 +2 more +4 moreAuthentication Bypass in Slican telephone exchanges9.3 Critical
- Show moreLoading…