Authentication Bypass Using an Alternate Path or Channel
CWE-288
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
We track 464 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 21 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Latest Authentication Bypass Using an Alternate Path or Channel vulnerabilities
- 8.1 High severity
Firefox: Authentication Bypass Using an Alternate Path or Channel
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.
- 7.5 High severity
router: Authentication Bypass Using an Alternate Path or Channel
Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access dat
- 9.8 Critical severity
Search & Go: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.
- 7.5 High severity
iOS and iPadOS: Authentication Bypass Using an Alternate Path or Channel
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. An app may be able to enumerate a user's installed apps.
- 9.8 Critical severity
Noo JobMonster: Authentication Bypass Using an Alternate Path or Channel
The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() function not properly verifying a user's identity prior to successfully authenticating them This makes i
- 7.5 High severity
Simple OAuth (OAuth2) & OpenID Connect: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuth (OAuth2) & OpenID Connect: from 6.0.0 before 6.0.7.
- 9.3 Critical severity
mMedica: Authentication Bypass Using an Alternate Path or Channel
An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging a previously authenticated connection through a "mmBackup" application. This flaw allows attackers to
- 8.1 High severity
Vault: Authentication Bypass Using an Alternate Path or Channel
Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Comm
- 8.8 High severity
Emails Catch All: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.
- 9.8 Critical severity
Simple Link Directory: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abuse.This issue affects Simple Link Directory: from n/a through < 14.8.1.
- 9.3 Critical severity
RAX701-GC-WP-01 P200R002C52: Authentication Bypass Using an Alternate Path or Channel
The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials.
- 7.5 High severity
Zoom Rooms: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.
- 9.8 Critical severity
Orion SMS OTP Verification.: Authentication Bypass Using an Alternate Path or Channel
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. Th
- 9.8 Critical severity
OwnID Passwordless Login: Authentication Bypass Using an Alternate Path or Channel
The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin not properly checking if the ownid_shared_secret value is empty prior to authenticating a user via J
- 8.8 High severity
Authenticator Login: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.
- 9.8 Critical severity
Search & Go - Directory WordPress Theme: Authentication Bypass Using an Alternate Path or Channel
The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7. This is due to insufficient user validation in the search_and_go_elated_check_facebook_user()
- 8.6 High severity
Telematics Control Unit (TCU): Improper Privilege Management
Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb fo
- 7.5 High severity
Baggage Analytics: Authentication Bypass Using an Alternate Path or Channel
The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.
- 8.6 High severity
karapace: Authentication Bypass Using an Alternate Path or Channel
Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization hea
- 9.8 Critical severity
Spirit Framework: Authentication Bypass Using an Alternate Path or Channel
The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_actions() function not properly validating a user's identity prior to authenticating them to the site. This
- 7.5 High severity
Apache Kylin: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
- 8.8 High severity
Camera Model LND7210: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor to gain access to camera information including user account information.
- 8.2 High severity
LatePoint – Calendar Booking Plugin for…: Authentication Bypass Using an Alternate Path or Channel
The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint in all versions up to, and including, 5.1.94. The endpoint reads the
- 8.1 High severity
Service Finder SMS System: Authentication Bypass Using an Alternate Path or Channel
The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthentica
- 8.8 High severity
CBIS,NCS: Authentication Bypass Using an Alternate Path or Channel
The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized access to API functions. This flaw allows attackers to reach restricted or sensitive endpoints of the
- 9.8 Critical severity
AdForest: Authentication Bypass Using an Alternate Path or Channel
The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated att
- 9.8 Critical severity
Sangoma FreePBX Authentication Bypass Exploited
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation
- 9.8 Critical severity
Jobmonster: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Jobmonster: from n/a through <= 4.7.9.
- 9.8 Critical severity
Golo: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through <= 1.7.0.
- 9.8 Critical severity
Unified Data Protection (UDP): Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accounts. By manipulating specific request parameters or exploiting a logic flaw, a
- 9.8 Critical severity
Case Theme User: Authentication Bypass Using an Alternate Path or Channel
The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging in a user with the data that was previously verified through the facebook_ajax_login_cal
- 8.1 High severity
Bravis User: Authentication Bypass Using an Alternate Path or Channel
The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callbac
- 9.8 Critical severity
Simpler Checkout: Authentication Bypass Using an Alternate Path or Channel
The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a user's identity prior to logging them in as an admin through the simplerwc_woocommerce_order_created
- 9.8 Critical severity
My-site: Authentication Bypass Using an Alternate Path or Channel
There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /admin/ API without any token.
- 9.8 Critical severity
AC6 V5.0: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send packets to trigger this vulnerability.
- 7.5 High severity
AC6 V5.0: Authentication Bypass Using an Alternate Path or Channel
An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets can lead to a disclosure of sensitive information. An attacker can send packets to trigger this vulner
- 9.8 Critical severity
Taxi Booking Manager for WooCommerce: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.3
- 9.8 Critical severity
Authenticator Login: Missing Authentication for Critical Functionality
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.4.
- 8.1 High severity
FortiProxy: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, Fo
- 7.6 High severity
RUGGEDCOM ROX MX5000: Authentication Bypass Using an Alternate Path or Channel
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDCOM ROX RX1500 (All versions), RUGGEDCOM ROX RX1501 (All versions), RUGGEDCOM ROX RX1510 (All versions