Authentication Bypass Using an Alternate Path or Channel
CWE-288
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
We track 464 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 21 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Latest Authentication Bypass Using an Alternate Path or Channel vulnerabilities
- 8.8 High severity
Swiss Toolkit For WP: Authentication Bypass Using an Alternate Path or Channel
The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.7. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for authenticated
- 9.8 Critical severity
OTP Login With Phone Number, OTP Verification: Authentication Bypass Using an Alternate Path or Channel
The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.26. This is due to the 'activation_code' default value is empty, and the not empty check is missing in the 'lwp_ajax_register' functio
- 9.8 Critical severity
Pie Register - Social Sites Login (Add on): Authentication Bypass Using an Alternate Path or Channel
The Pie Register - Social Sites Login (Add on) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.7. This is due to insufficient verification on the user being supplied during a social login through the plugin. Th
- 9.8 Critical severity
Social Connect: Authentication Bypass Using an Alternate Path or Channel
The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possibl
- 9.8 Critical severity
Edwiser Bridge – WordPress Moodle Integration: Authentication Bypass Using an Alternate Path or Channel
The Edwiser Bridge plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.5. This is due to the 'eb_user_email_verification_key' default value is empty, and the not empty check is missing in the 'eb_user_email_verify'
- 9.1 Critical severity
open_agents: Authentication Bypass Using an Alternate Path or Channel
In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the nature of the file content.
- 8.2 High severity
parisneo/lollms-webui: Authentication Bypass Using an Alternate Path or Channel
parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a speci
- 9.8 Critical severity
Artica Proxy: Authentication Bypass Using an Alternate Path or Channel
Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service is running, running as the root user, is bound to the loopback interface, and is listening on TCP po
- 9.8 Critical severity
Artica Proxy: Authentication Bypass Using an Alternate Path or Channel
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user.
- 9.8 Critical severity
JetBrains TeamCity Authentication Bypass Exploited
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
- 10.0 Critical severity
ConnectWise ScreenConnect Authentication Bypass Exploited
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
- 9.8 Critical severity
HPE Integrated Lights-out 5 (iLO 5), HPE…: Authentication Bypass Using an Alternate Path or Channel
A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be remotely exploited to allow authentication bypass.
- 7.5 High severity
Repox: Missing Authentication for Critical Functionality
An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to the lack of any authentication method, resulting in the alteration or creation of users.
- 8.1 High severity
UserPro - Community and User Profile WordPress…: Improper Authentication
The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthen
- 9.8 Critical severity
ST-IPm-8460: Missing Authentication for Critical Functionality
Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentic
- 9.8 Critical severity
MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel
The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any
- 9.8 Critical severity
NOKIA G-040W-Q: Missing Authentication for Critical Functionality
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remot
- 9.8 Critical severity
F5 BIG-IP Configuration Utility Authentication Bypass Exploited
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have re
- 9.8 Critical severity
PingID Radius PCV: Missing Authentication for Critical Functionality
A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request.
- 7.5 High severity
Sterling Partner Engagement Manager: Missing Authentication for Critical Functionality
IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896.
- 7.5 High severity
bastion: Authentication Bypass Using an Alternate Path or Channel
WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on a network access administration web interface.
- 8.8 High severity
ACERA 1320: Improper Authentication
Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log fi
- 8.0 High severity
Red Hat OpenShift Container Platform 4.10: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would th
- 9.8 Critical severity
JetBrains TeamCity Authentication Bypass Exploited
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
- 9.8 Critical severity
Digital Yepas: Missing Authentication for Critical Functionality
Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas: before 1.0.1.
- 9.1 Critical severity
MAGLINK LX Web Console Configuration: Authentication Bypass Using an Alternate Path or Channel
Dover Fueling Solutions MAGLINK LX Web Console Configuration versions 2.5.1, 2.5.2, 2.5.3, 2.6.1, 2.11, 3.0, 3.2, and 3.3 are vulnerable to authentication bypass that could allow an unauthorized attacker to obtain user access.
- 9.1 Critical severity
Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Exploited
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify val
- 9.8 Critical severity
Payment Gateway of Stripe for WooCommerce: Authentication Bypass Using an Alternate Path or Channel
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This
- 9.8 Critical severity
Node: Authentication Bypass Using an Alternate Path or Channel
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and,
- 9.8 Critical severity
Web3 – Crypto wallet Login & NFT token gating: Authentication Bypass Using an Alternate Path or Channel
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible f
- 9.8 Critical severity
Bookit — Booking & Appointment Calendar: Missing Authentication for Critical Functionality
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for una
- 9.8 Critical severity
miniOrange Social Login and Register (Discord…: Authentication Bypass Using an Alternate Path or Channel
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login v
- 9.1 Critical severity
MegaRAC_SPx: Missing Authentication for Critical Functionality
AMI BMC contains a vulnerability in the IPMI handler, where an unauthenticated host is allowed to write to a host SPI flash, bypassing secure boot protections. An exploitation of this vulnerability may lead to a loss of integrity or denial of service.
- 9.8 Critical severity
Abandoned Cart Lite for WooCommerce: Authentication Bypass Using an Alternate Path or Channel
The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the pl
- 8.8 High severity
WP User Switch: Authentication Bypass Using an Alternate Path or Channel
The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value
- 9.8 Critical severity
User Email Verification for WooCommerce: Missing Authentication for Critical Functionality
The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email f
- 9.8 Critical severity
MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This m
- 9.8 Critical severity
MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes
- 9.8 Critical severity
MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it po
- 9.8 Critical severity
BP Social Connect: Missing Authentication for Critical Functionality
The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for