CWE-288 Authentication Bypass Using an Alternate Path or Channel
baseThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (777)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-19490US | critical9.8OT critical | KEV | ||
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 t… | ||||
| CVE-2026-18577US | high8.1OT critical | KEV | ||
An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | ||||
| CVE-2026-18556US | high7.4OT critical | KEV | ||
Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
This issue affects N-central: through 2026.1. | ||||
| CVE-2026-20079US | —OT critical | KEV | ||
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute… | ||||
| CVE-2026-1603US | high7.5OT critical | KEV | ||
An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data. | ||||
| CVE-2026-24858US | —OT critical | KEV | ||
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9,… | ||||
| CVE-2026-23760US | critical9.8OT critical | KEV | ||
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous… | ||||
| CVE-2025-57819US | critical9.8OT critical | KEV | ||
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenti… | ||||
| CVE-2025-34026US | high7.5OT critical | KEV | ||
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative… | ||||
| CVE-2025-4427US | high7.5OT critical | KEV | ||
An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the… | ||||
| CVE-2025-2747US | —OT critical | KEV | ||
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. A… | ||||
| CVE-2025-2746US | —OT critical | KEV | ||
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames in digest authenticat… | ||||
| CVE-2025-24472US | —OT critical | KEV | ||
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19… | ||||
| CVE-2024-55591US | critical9.8OT critical | KEV | ||
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7… | ||||
| CVE-2024-27198US | critical9.8OT critical | KEV | ||
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible | ||||
| CVE-2024-1709US | critical10.0OT critical | KEV | ||
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an attacker direct access to… | ||||
| CVE-2023-46747US | critical9.8OT critical | KEV | ||
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addre… | ||||
| CVE-2023-42793US | critical9.8OT critical | KEV | ||
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible | ||||
| CVE-2023-20269US | critical9.1OT critical | KEV | ||
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticate… | ||||
| CVE-2020-10148US | critical9.8OT critical | KEV | ||
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to b… | ||||
04
attack patterns (2)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan