Authentication Bypass Using an Alternate Path or Channel
CWE-288
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
We track 464 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 21 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Latest Authentication Bypass Using an Alternate Path or Channel vulnerabilities
- 8.1 High severity
next.js: Authentication Bypass Using an Alternate Path or Channel
Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafte
- 9.3 Critical severity
WRC-BE72XSD-B: Authentication Bypass Using an Alternate Path or Channel
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
- 9.3 Critical severity
devguard: Authentication Bypass Using an Alternate Path or Channel
DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session co
- 7.3 High severity
agents: Improper Authentication
A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.ts of the component runAuth Middleware. Performing a manipulation results in authentication bypass usi
- 9.8 Critical severity
User Verification by PickPlugins: Authentication Bypass Using an Alternate Path or Channel
The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the "user_verification_form_wrap_p
- 9.8 Critical severity
Temporary Login: Authentication Bypass Using an Alternate Path or Channel
The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET
- 8.2 High severity
Apache Camel Platform HTTP Main: Authentication Bypass Using an Alternate Path or Channel
When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthentic
- 9.8 Critical severity
X3050: Authentication Bypass Using an Alternate Path or Channel
A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with network access to the device may be able to bypass the intended authenticat
- 8.2 High severity
oauth2-proxy: Authentication Bypass Using an Alternate Path or Channel
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-dependent authentication bypass. Deployments are affected when all of the following are true: Use of `skip_auth_routes` or t
- 9.8 Critical severity
Firefox: Authentication Bypass Using an Alternate Path or Channel
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- 9.1 Critical severity
CRM: Authentication Bypass Using an Alternate Path or Channel
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user's API key, bypassing the normal authentication flow that enforces account l
- 8.1 High severity
Vault: Authentication Bypass Using an Alternate Path or Channel
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets acr
- 8.2 High severity
ManageEngine Log360: Authentication Bypass Using an Alternate Path or Channel
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
- 9.8 Critical severity
Visa Acceptance Solutions: Authentication Bypass Using an Alternate Path or Channel
The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.1.0. This is due to the `express_pay_product_page_pay_for_order()` function logging users in based solely on a user-supplied billi
- 9.8 Critical severity
Oai-cn5g-amf: Authentication Bypass Using an Alternate Path or Channel
In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. This allows authentication to be bypassed completely. If a SecurityModeComplete message is sent after InitialUERegistration, a registra
- 8.1 High severity
goshs: Authentication Bypass Using an Alternate Path or Channel
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been pat
- 7.5 High severity
macOS: Authentication Bypass Using an Alternate Path or Channel
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard events to apps running on a locked device.
- 9.4 Critical severity
signalk-server: Improper Authorization
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator acc
- 9.8 Critical severity
Secure Email Gateway: Authentication Bypass Using an Alternate Path or Channel
SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.
- 7.8 High severity
moby: Authentication Bypass Using an Alternate Path or Channel
Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
- 8.7 High severity
BUFFALO Wi-Fi router products: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication.
- 8.1 High severity
GitLab: Authentication Bypass Using an Alternate Path or Channel
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized acces
- 9.8 Critical severity
Jobica Core: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.
- 8.1 High severity
Tutor LMS Pro: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor LMS Pro: from n/a through <= 3.9.4.
- 8.1 High severity
Ultimate Membership Pro: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.This issue affects Ultimate Membership Pro: from n/a through <= 13.7.
- 9.8 Critical severity
Contest Gallery: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.
- 7.5 High severity
LearnPress – Sepay Payment: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in ThimPress LearnPress – Sepay Payment learnpress-sepay-payment allows Authentication Abuse.This issue affects LearnPress – Sepay Payment: from n/a through <= 4.0.0.
- 8.8 High severity
Dokan: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issue affects Dokan: from n/a through <= 4.2.4.
- 9.8 Critical severity
Firefox: Authentication Bypass Using an Alternate Path or Channel
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
- 8.8 High severity
blinko: Authentication Bypass Using an Alternate Path or Channel
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues: it is missing superAdminAuthMiddleware, any logged-in user can call it; the originalPassword is an op
- 8.1 High severity
Spring Security: Authentication Bypass Using an Alternate Path or Channel
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Sec
- 8.1 High severity
Spring Boot: Missing Authentication for Critical Functionality
Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path. This issue
- 8.2 High severity
OpenClaw: Authentication Bypass Using an Alternate Path or Channel
OpenClaw versions prior to 2026.3.2 contain an authentication bypass vulnerability in the /api/channels route classification due to canonicalization depth mismatch between auth-path classification and route-path canonicalization. Attackers can bypass plugin ro
- 8.1 High severity
Admin Safety Guard: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.6.
- 7.5 High severity
zitadel: Authentication Bypass Using an Alternate Path or Channel
ZITADEL is an open source identity management platform. From 2.68.0 to before 3.4.8 and 4.12.2, Zitadel provides a System for Cross-domain Identity Management (SCIM) API to provision users from external providers into Zitadel. Request to the API with URL-encod
- 7.2 High severity
EDS3000PS series: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The host parameter of the TFTP client in the Filesystem Browser page is not properly sanitized. This can be exploited to escape from the original command and execute an arbitrary one with root privilege
- 9.8 Critical severity
EDS3000PS series: Authentication Bypass Using an Alternate Path or Channel
An issue was discovered in Lantronix EDS3000PS 3.1.0.0R2. The authentication on management pages can be bypassed by appending a specific suffix to the URL and by sending an Authorization header that uses "admin" as the username.
- 9.3 Critical severity
MR-GM5L-S1: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration.
- 7.8 High severity
Arc Enabled Servers - Azure Connected Machine…: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
- 7.2 High severity
FortiAnalyzer: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.2 through 7.2.12, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7,