Authentication Bypass Using an Alternate Path or Channel
CWE-288
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
We track 464 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 21 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Latest Authentication Bypass Using an Alternate Path or Channel vulnerabilities
- 8.8 High severity
Cisco Business Wireless Access Point Software: Missing Authentication for Critical Functionality
A vulnerability in the social login configuration option for the guest users of Cisco Business Wireless Access Points (APs) could allow an unauthenticated, adjacent attacker to bypass social login authentication. This vulnerability is due to a logic error with
- 9.8 Critical severity
RegistrationMagic – Custom Registration Forms…: Improper Authentication
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it poss
- 8.8 High severity
SEL-3505: Improper Authentication
An Authentication Bypass Using an Alternate Path or Channel vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) Web Interface allows Authentication Bypass. See SEL Service Bulletin dated 2022-11-15 for more detai
- 7.8 High severity
Android: Authentication Bypass Using an Alternate Path or Channel
In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User inte
- 9.8 Critical severity
ZM Ajax Login & Register: Improper Authentication
The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it poss
- 9.8 Critical severity
izanami: Use of Hard-coded Credentials
Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authentication in this application when deployed using the official Docker image. Because a hard coded secret is used to sign the auth
- 8.2 High severity
NVIDIA DGX servers: Missing Authentication for Critical Functionality
NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The sc
- 8.2 High severity
NVIDIA DGX servers: Missing Authentication for Critical Functionality
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope
- 7.1 High severity
NVIDIA DGX servers: Missing Authentication for Critical Functionality
NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and denial of service.
- 7.8 High severity
manageengine_device_control_plus: Authentication Bypass Using an Alternate Path or Channel
An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still poss
- 9.8 Critical severity
PowerStore: Improper Authentication
Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability under specific configuration. An attacker would gain unauthorized access upon successful exploit.
- 9.8 Critical severity
SecureGate: Improper Limitation of a Pathname to a Restricted Directory
This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privile
- 7.1 High severity
xwiki-platform: Improper Authentication
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. By passing a template of the distribution wizard to the xpart template, user accounts can be created even when user registration is disabled. This also circumvents any emai
- 9.1 Critical severity
Cyber Recovery: Improper Authentication
Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially access and interact with the docker registry API leading to an authentication bypass. The attacker may
- 8.8 High severity
samba: Improper Authentication
A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw t
- 9.8 Critical severity
Ignition: Authentication Bypass Using an Alternate Path or Channel
This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required to exploit this vulnerability. The specific flaw exists within com.inductiveauto
- 9.8 Critical severity
Chcnav - P5E GNSS: Improper Authentication
The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass the identification with the system using a username and password.
- 8.2 High severity
PingID Windows Login: Improper Privilege Management
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically
- 8.1 High severity
PingID Integration for Windows Login: Use of Hard-coded Credentials
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user crede
- 7.7 High severity
PingFederate PingOne MFA Integration Kit: Improper Authentication
An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.
- 9.8 Critical severity
Security Optimizer – The All-In-One Protection…: Missing Authentication for Critical Functionality
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized user
- 7.8 High severity
Contrail Service Orchestration: Authentication Bypass Using an Alternate Path or Channel
An Incorrect Ownership Assignment vulnerability in Juniper Networks Contrail Service Orchestration (CSO) allows a locally authenticated user to have their permissions elevated without authentication thereby taking control of the local system they are currently
- 9.8 Critical severity
Track-It!: Improper Authentication
This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The i
- 9.8 Critical severity
SolarWinds Orion Authentication Bypass Exploited
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise o