Authentication Bypass Using an Alternate Path or Channel
CWE-288
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
We track 464 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 21 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Latest Authentication Bypass Using an Alternate Path or Channel vulnerabilities
- 8.7 High severity
EasyIO FW: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass. This issue affects EasyIO FW: through 3.0b25.
- 8.8 High severity
TIBCO Platform’s Self-Hosted Control Plane: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane. This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.
- 9.3 Critical severity
Payara Server: Authentication Bypass Using an Alternate Path or Channel
A vulnerability in the administration REST interface of Azul Payara allows a remote, unauthenticated attacker to bypass secure-admin remote-access restrictions by supplying an arbitrary value in the X-GlassFish-authToken HTTP header. The header's presence waiv
- 8.6 High severity
DiskStation Manager (DSM): Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary
- 8.1 High severity
DiskStation Manager (DSM): Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct d
- 7.5 High severity
supertokens-core: Authentication Bypass Using an Alternate Path or Channel
SuperTokens Core is an open source authentication server. Prior to 11.3.6, 11.4.6, and 12.0.8, app-specific management requests using an unknown tenant path and an older supported cdi-version can bypass API-key and public-tenant enforcement. In src/main/java/i
- 9.8 Critical severity
API Connect: Authentication Bypass Using an Alternate Path or Channel
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.
- 9.8 Critical severity
ownCloud: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authenticat
- 8.4 High severity
openhuman: Authentication Bypass Using an Alternate Path or Channel
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalen
- 7.5 High severity
Apache OFBiz: Authentication Bypass Using an Alternate Path or Channel
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW
- 7.5 High severity
Apache OFBiz: Authentication Bypass Using an Alternate Path or Channel
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /
- 9.2 Critical severity
glpi: Authentication Bypass Using an Alternate Path or Channel
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in versi
- 7.5 High severity
traccar: Exposure of Sensitive Information to an Unauthorized Actor
Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, WebModule.java's MediaFilter Guice mapping and WebServer.java's Jetty ResourceServlet assign different routing meanings to path parameters at /api/media/*. An unauthenticated attacker who kn
- 9.1 Critical severity
StorageGRID (formerly StorageGRID Webscale): Authentication Bypass Using an Alternate Path or Channel
StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.
- 7.4 High severity
ManageEngine Key Manager Plus: Authentication Bypass Using an Alternate Path or Channel
ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.
- 8.7 High severity
EasyIO Neo EC and CW Edge Controller: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW
- 9.8 Critical severity
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Exploited
An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modific
- 9.9 Critical severity
Secret Server (On-Prem): Authentication Bypass Using an Alternate Path or Channel
In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.
- 8.8 High severity
lago: Authentication Bypass Using an Alternate Path or Channel
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept wit
- 7.3 High severity
CAPTCHA: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.
- 9.4 Critical severity
FearlessCMS: Improper Limitation of a Pathname to a Restricted Directory
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or ade
- 8.8 High severity
Apache Kafka: Authentication Bypass Using an Alternate Path or Channel
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring
- 8.5 High severity
ONE: Authentication Bypass Using an Alternate Path or Channel
A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.
- 9.2 Critical severity
Fireware OS: Integer Overflow or Wraparound
An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access
- 9.8 Critical severity
FortiSandbox: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions,
- 9.8 Critical severity
ArubaOS (AOS): Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete comprom
- 10.0 Critical severity
ArubaOS (AOS): Authentication Bypass Using an Alternate Path or Channel
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary
- 10.0 Critical severity
ArubaOS (AOS): Authentication Bypass Using an Alternate Path or Channel
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitatio
- 8.1 High severity
Webmail: Authentication Bypass Using an Alternate Path or Channel
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qual
- 8.7 High severity
traefik: Authentication Bypass Using an Alternate Path or Channel
Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 build
- 8.8 High severity
MOVEit Transfer: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- 10.0 Critical severity
dockhand: Authentication Bypass Using an Alternate Path or Channel
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated calle
- 8.8 High severity
RAX30: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vuln
- 9.8 Critical severity
Planning Analytics: Authentication Bypass Using an Alternate Path or Channel
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
- 8.1 High severity
nginx-ui: Authentication Bypass Using an Alternate Path or Channel
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_mod
- 7.1 High severity
Grocery Shopping Store: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
- 9.8 Critical severity
TVU Receiver / Transceiver: Authentication Bypass Using an Alternate Path or Channel
TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session b
- 8.8 High severity
Fabric OS: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Si
- 9.2 Critical severity
iSolarCloud: Authentication Bypass Using an Alternate Path or Channel
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is requir
- 9.3 Critical severity
FlexNet Publisher: Authentication Bypass Using an Alternate Path or Channel
A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session without providing va