CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
A kind of CWE-306 Missing Authentication for Critical Functionality.
From the CWE List. © The MITRE Corporation.
Newest
- red lion controls 700 seriesRed Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel6.8 Medium
- automattic jetpackWordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability4.8 Medium
- automattic jetpackWordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability5.4 Medium
- tvu networks receiver / transceiverTVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login9.3 Critical
- cisa malcolmAuthentication Bypass Using an Alternate Path or Channel in Malcolm4.2 Medium
- brocade fabric os, broadcom fabric operating system +1 moreAn authentication bypass vulnerability exists in the web management interface of Brocade Fabric...7.7 High
- drupal authenticator login plus (2fa)Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-2014.2 Medium
- drupal authenticator login plus (2fa)Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-1974.8 Medium
- sungrow isolarcloudSungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type...9.2 Critical
- flexera flexnet publisherFlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability9.3 Critical
- webfactory advanced google recaptchaWordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability5.3 Medium
- nicu micle simple jwt loginWordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability8.8 High
- iqonic designs graphina – charts and graphs for elementorWordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible...5.4 Medium
- nestjs nestNest: Remote process termination via a deeply nested microservice message pattern7.5 High
- unknown blacklist managerBlacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application Passwords5.4 Medium
- grokability snipe-itSnipe-IT: 2FA bypass via the API token flow8.6 High
- portswigger burp suite dastIn PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an...9.2 Critical
- qtAuthentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module4.5 Medium
- drupal stop administrator loginStop administrator login - Moderately critical - Access bypass - SA-CONTRIB-2026-1833.8 Low
- drupal rest & json api authentication for drupalREST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-1826.5 Medium
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability7.3 High
- devolutions serverSync-in Server has a complete 2FA Bypass via `POST /api/auth/token`8.1 High
- kiteworks security-advisoriesSteeltoe: Header-forwarded client cert lacks proof of private-key possession6.5 Medium
- chris gårdenberg, multinet interactive ab eduadmin bookingWordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability9.8 Critical
- kong enterprise gatewayKong API Gateway Enterprise: SAML Authentication bypass7.7 High
- carlo gavazzi automation yl212cei8m1io, yl212cpn8m1io, yn115cei8rpio +12 more +14 moreAuthentication Bypass in _account_log9.8 Critical
- snail007 goproxygoproxy through 15.3 Authentication Bypass via CONNECT6.9 Medium
- brainzcompany zenius ems 8.0Authentication bypass using an alternate path or channel and Improper validation of syntactic...8.7 High
- concrete cms cms[UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks6.3 Medium
- wen solutions wp travel, wp travel travel +1 moreWordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability7.3 High
- idx broker impress for idx brokerWordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability6.5 Medium
- mailmunch – grow your email listWordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability7.1 High
- cap-go capgo.appCapgo AAL1 Session MFA Bypass via Direct RBAC Authorization8.7 High
- n8nn8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions6.0 Medium
- ivanti sentryAn Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a...8.1 High
- commvault, commvault cloud +1 moreCommServe Information Disclosure8.7 High
- siemens reyrolle 7sr5A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side...8.7 High
- @clerk fastifyfastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers7.5 High
- microsoft entra id, entra +1 moreMicrosoft Entra ID Elevation of Privilege Vulnerability9.1 Critical
- really simple plugins simple sslWordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability7.4 High
- drupal email verification / sms verification / otp verificationEmail Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-1246.5 Medium
- google androidIn maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible...7.8 High
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability7.4 High
- gophishGophish Account Lockout and Forced Password Change Bypassable via API Key8.6 High
- xiiaozet lk100wXiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel9.3 Critical
- samsung open source oneA vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from...9.3 Critical
- drupal disable login pageDisable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-1114.1 Medium
- captcha protected page project protected page, drupal captcha protected page +1 moreCAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-1053.7 Low
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab5.5 Medium
- Show moreLoading…