cve.bz

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Filter

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

What the weakness is: CWE-288 at MITRE

Ask an AI about CWE-288

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-288: Authentication Bypass Using an Alternate Path or Channel and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/288.html and https://cve.bz/cve/cwe/288?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.7CVE-2026-71450

    Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through …

  2. 9.3CVE-2026-116606

    An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in…

  3. 8.7CVE-2026-115829EPSS 0.3%

    In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.

  4. 8.7CVE-2026-119420EPSS 0.4%

    Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victi…

  5. –CVE-2026-118582EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11.

  6. –CVE-2026-118572EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1.

  7. –CVE-2026-118554EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1.

  8. 5.4CVE-2026-114572EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.

  9. –CVE-2026-114539EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x.

  10. 4.2CVE-2026-107261EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

  11. 4.8CVE-2026-107254EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.

  12. 9.4CVE-2026-63190EPSS 0.5%

    FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, C…

  13. 6.3CVE-2026-118681EPSS 0.2%

    go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted router's parameter and child suffix in place for dispatch against the outer route…

  14. 8.5CVE-2026-107671EPSS 0.3%

    A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA verification.

  15. 9.2CVE-2026-93866EPSS 0.5%

    An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted requ…

  16. 7.5CVE-2026-116638EPSS 0.4%

    The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a devic…

  17. 9.8CVE-2026-107656EPSS 0.9%

    An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox Pa…

  18. 9.8CVE-2026-79855EPSS 0.8%

    An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leadin…

  19. 10.0CVE-2026-79850EPSS 0.7%

    Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker…

  20. 10.0CVE-2026-79844EPSS 0.7%

    Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. S…

  21. 6.8CVE-2026-114732EPSS 0.4%

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity…

  22. 3.8CVE-2026-96387EPSS 0.3%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. This issue affects Stop administrator login versions: from 1.0 to 1.6.

  23. 6.5CVE-2026-96385EPSS 0.3%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows Authentication Bypass. This issue affects REST & JSON API Authentication for Drupal versions: from 0.0.0 to 3…

  24. 6.5CVE-2026-84923EPSS 0.3%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verifica…

  25. 7.0CVE-2026-114635EPSS 0.2%

    Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over…

  26. 6.5CVE-2026-111438EPSS 0.4%

    在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远…

  27. 6.9CVE-2026-111712EPSS 0.2%

    Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefi…

  28. 7.0CVE-2026-89057EPSS 0.2%

    A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.

  29. 9.3CVE-2026-19863EPSS 0.5%

    An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when ident…

  30. 6.3CVE-2026-110852EPSS 0.4%

    n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only …

  31. 8.8CVE-2026-89067EPSS 0.5%

    Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

  32. 5.5CVE-2026-85865EPSS 0.3%

    Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.

  33. 5.5CVE-2026-83787EPSS 0.3%

    Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.

  34. 10.0CVE-2026-110130EPSS 0.7%

    Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for …

  35. 6.3CVE-2026-11731EPSS 0.3%

    An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrativ…

  36. 9.8CVE-2026-19622EPSS 0.3%

    IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

  37. 8.8CVE-2026-19620EPSS 0.3%

    IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.

  38. 8.1CVE-2026-84360EPSS 0.4%

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add…

  39. 7.3CVE-2026-62038EPSS 0.3%

    Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

  40. 7.1CVE-2026-93949EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.

  41. 6.8CVE-2026-33272EPSS 0.1%

    A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so…

  42. 4.8CVE-2026-106602EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

  43. 5.4CVE-2026-106601EPSS 0.2%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.

  44. 9.3CVE-2026-104075EPSS 0.6%

    TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an adm…

  45. 4.2CVE-2026-107361EPSS 0.2%

    The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0…

  46. 7.7CVE-2026-94585EPSS 0.2%

    An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint…

  47. 9.2CVE-2026-107194EPSS 0.4%

    Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_accou…

  48. 9.3CVE-2026-19572EPSS 0.4%

    A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator session…

  49. 8.8CVE-2026-39793EPSS 0.4%

    Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

  50. 7.5CVE-2026-39769EPSS 0.5%

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Password Recovery Exploitation.This issue affects Graphina – Ch…