Authentication Bypass Using an Alternate Path or Channel
CWE-288
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
We track 464 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 9.0. 21 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Latest Authentication Bypass Using an Alternate Path or Channel vulnerabilities
- 7.2 High severity
Vitepos: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.7.
- 9.8 Critical severity
SMS Alert – SMS & OTP for WooCommerce, Order…: Missing Authentication for Critical Functionality
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.7.9. This is due to the plugin using the Host header to determine if the plugin is in a play
- 9.8 Critical severity
Apache Pinot: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\
- 9.8 Critical severity
Material Dashboard: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Hossein Material Dashboard material-dashboard allows Authentication Bypass.This issue affects Material Dashboard: from n/a through <= 1.4.5.
- 8.8 High severity
Vitepos: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.
- 7.6 High severity
iOS and iPadOS: Authentication Bypass Using an Alternate Path or Channel
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4. An app may be able to bypass Privacy preferences.
- 8.1 High severity
Two-factor Authentication (TFA): Authentication Bypass Using an Alternate Path or Channel
Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
- 7.8 High severity
VMware Tools: Authentication Bypass Using an Alternate Path or Channel
VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges on a guest VM may gain ability to perform certain high privilege operations within that VM.
- 9.8 Critical severity
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Exploited
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This i
- 9.8 Critical severity
Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Exploited
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authentication. Authentication bypass allows an attacker to control administrative objects.
- 9.8 Critical severity
Service Finder Bookings: Authentication Bypass Using an Alternate Path or Channel
The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0. This is due to the plugin not properly validating a user's identity prior to (1) performing a post-booking au
- 9.8 Critical severity
WP JobHunt: Authentication Bypass Using an Alternate Path or Channel
The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the cs_parse_request() function. This
- 9.3 Critical severity
Visual BACnet Capture Tool: Authentication Bypass Using an Alternate Path or Channel
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
- 8.2 High severity
CAP back office application: Authentication Bypass Using an Alternate Path or Channel
This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote attacker with valid credentials could exploit this vulnerability by manipulating API request URL/payload.
- 9.8 Critical severity
Workreap: Authentication Bypass Using an Alternate Path or Channel
The Workreap plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.2.5. This is due to the plugin not properly validating a user's identity prior to (1) performing a social auto-login or (2) upd
- 9.8 Critical severity
InWave Jobs: Missing Authentication for Critical Functionality
The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possi
- 8.8 High severity
School Management System for Wordpress: Missing Authentication for Critical Functionality
The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 93.0.0. This is due to the plugin not properly validating a user's identity prior to updating their
- 8.1 High severity
Homey: Authentication Bypass Using an Alternate Path or Channel
The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it po
- 9.8 Critical severity
WP Real Estate Manager: Authentication Bypass Using an Alternate Path or Channel
The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticate
- 7.5 High severity
FutureNet AS-250/S: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass vulnerability exists in FutureNet AS series (Industrial Routers) provided by Century Systems Co., Ltd. If this vulnerability is exploited, a remote unauthenticated attacker may obtain the device information such as MAC address by sending
- 9.8 Critical severity
Academist Membership: Authentication Bypass Using an Alternate Path or Channel
The Academist Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.6. This is due to the academist_membership_check_facebook_user() function not properly verifying a user's identity prior to authentica
- 9.8 Critical severity
Alloggio Membership: Authentication Bypass Using an Alternate Path or Channel
The Alloggio Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity through the alloggio_membership_init_rest_api_facebook_login an
- 9.8 Critical severity
SetSail Membership: Authentication Bypass Using an Alternate Path or Channel
The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a users identity through the social login. This makes it possible for unauthenticated attackers to log in
- 9.1 Critical severity
Storage Virtualize: Missing Authentication for Critical Functionality
IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1
- 7.1 High severity
Camera NC227WF: Authentication Bypass Using an Alternate Path or Channel
An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator's credentials in cleartext by sending a request against the server using curl with
- 8.1 High severity
Login Me Now – Passwordless, Magic Link, OTP &…: Missing Authentication for Critical Functionality
The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for
- 9.8 Critical severity
PrivateContent: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.5.
- 9.8 Critical severity
WP Directorybox Manager: Authentication Bypass Using an Alternate Path or Channel
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attacke
- 8.1 High severity
Fortinet FortiOS and FortiProxy Authentication Bypass Exploited
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream an
- 9.8 Critical severity
WP Foodbakery: Authentication Bypass Using an Alternate Path or Channel
The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.8. This is due to the plugin not properly validating a user's identity prior to setting the current user and their authent
- 9.8 Critical severity
WP Directorybox Manager: Authentication Bypass Using an Alternate Path or Channel
The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_enquiry_agent_contact_form_submit_callback' function. This makes it possible fo
- 9.8 Critical severity
Nextend Social Login Pro: Authentication Bypass Using an Alternate Path or Channel
The Nextend Social Login Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.16. This is due to insufficient verification on the user being supplied during the Apple OAuth authenticate request through the plugi
- 9.8 Critical severity
Signum DVB-S/S2 IRD: Authentication Bypass Using an Alternate Path or Channel
Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the
- 8.2 High severity
mitmproxy: Authentication Bypass Using an Alternate Path or Channel
mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmweb 11.1.1 and below, a malicious client can use mitmweb's proxy server (bound to `*:8080`
- 9.8 Critical severity
BigAnt Server: Authentication Bypass Using an Alternate Path or Channel
BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticated remote attacker can create an administrative user through the default exposed SaaS registration me
- 9.8 Critical severity
AdForest: Missing Authentication for Critical Functionality
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.1.8. This is due to the plugin not properly verifying a user's identity prior to logging them in as that user. This makes it possible for unauthenti
- 9.8 Critical severity
Avalanche: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010.
- 9.8 Critical severity
Fortinet FortiOS and FortiProxy Authentication Bypass Exploited
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via
- 9.8 Critical severity
TC Ecommerce – Create Android & iOS Apps for…: Authentication Bypass Using an Alternate Path or Channel
The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's ident
- 9.8 Critical severity
WPLMS: Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.