CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- freebsdUnauthorized credential switching8.1 High
- weidmueller ie-sr-2tx-wl-4g-eu, ie-sr-2tx-wl-4g-us-v +1 moreSMS Password Authorization Bypass via Failed Attempt Counter8.8 High
- wp legal pages wplegalpagesWordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability7.3 High
- wpeverest user registration & membership proWordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability9.8 Critical
- vaultdweller leykaWordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability7.6 High
- citrix netscaler, netscaler gateway, netscaler adc +2 more +4 moreNetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-194909.3 Critical
- rargames 4gaboards4gaBoards: Pre-Account Takeover via SSO Email Linkage8.8 High
- nvidia nvosNVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server...7.1 High
- gbif integrated publishing toolkitAuthentication bypass in Integrated Publishing Toolkit9.1 Critical
- flutterwave woocommerceWordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability6.5 Medium
- enartia piraeus bank woocommerce payment gatewayWordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability6.5 Medium
- makewebbetter mwb hubspot for woocommerceWordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerability7.1 High
- supsystic popup by supsysticWordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability9.1 Critical
- supsystic contact form by supsysticWordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability6.5 Medium
- ezoicWordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability7.5 High
- bastillion-io bastillionBastillion Authentication Bypass via Path-Prefix Routing Mismatch9.3 Critical
- No product listedAn Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which...5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated...9.1 Critical
- agnihd cartifyWordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability9.8 Critical
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability9.8 Critical
- fortinet fortimanager, fortimanager cloud +1 moreA authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager...7.3 High
- rapid7 velociraptorVelociraptor VFSGetBuffer API path deny list bypass6.8 Medium
- opensignlabs opensignserverOpenSignLabs opensignserver - Authentication Bypass7.5 High
- arraytics wp event solutionWordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability6.5 Medium
- saad iqbal gutena forms – contact form, survey form, feedback form, booking form, and custom form builderWordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability6.5 Medium
- rajat varlani super socializerWordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability8.8 High
- nvidia dynamoNVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an...9.8 Critical
- veeam service provider consoleA vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to...9.5 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Authentication Bypass via Content Endpoints9.2 Critical
- checkpoint multi-domain security management server, security management server +1 moreAuthentication Bypass in Check Point Security Management Server9.3 Critical
- tranquil it systems wapt serverAuthentication bypass on WaptServer10.0 Critical
- n-able n-centralIncomplete patch leads to administrative account takeover8.2 High
- n-able n-centralUnauthenticated administrative account takeover8.2 High
- traefikTraefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass7.8 High
- black duck coverity connectAuthentication and Authorization Bypass in Coverity Connect9.2 Critical
- teamviewer remote, samsung open source one, teamviewer tensor +2 moreBypass of 2FA for Connections via Unattended Access in TeamViewer for macOS8.0 High
- red hat certificate system 10, certificate system 11, certificate system 9 +5 more +7 moreDogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash6.5 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter9.8 Critical
- tycon systems tpdin-monitor-web2Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function9.3 Critical
- miniorange discord integrationWordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability8.1 High
- easy digital downloads digital downloads, sandhills development, llc easy digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.6.7 - Broken Authentication vulnerability6.5 Medium
- netapp ontap, ontap 9 +1 moreONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are...8.7 High
- drupal internationalization single sign-onInternationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-0819.8 Critical
- balbooa.com gridbox extension for joomlaJoomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.09.4 Critical
- frappe lmsFrappe LMS enrollment bypass in paid courses via unrelated batch7.1 High
- sipeed picoclawSipeed PicoClaw First Run Setup access_control.go authentication bypass6.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Tampering Vulnerability5.4 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an...6.5 Medium
- villatheme abandoned cart recovery for woocommerceWordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability6.5 Medium
- metagauss profilegridWordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability7.5 High
- Show moreLoading…