CWEweakness
CWE-288 Authentication Bypass Using an Alternate Path or Channel
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Common consequences
• Access Control: Bypass Protection Mechanism
Potential mitigations
• [Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Observed examples
• CVE-2000-1179: Router allows remote attackers to read system logs without authentication by directly connecting to the login screen and typing certain control characters.
• CVE-1999-1454: Attackers with physical access to the machine may bypass the password prompt by pressing the ESC (Escape) key.
• CVE-1999-1077: OS allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.
• CVE-2003-0304: Direct request of installation file allows attacker to create administrator accounts.
• CVE-2002-0870: Attackers may gain additional privileges by directly requesting the web management URL.
• CVE-2002-0066: Bypass authentication via direct request to named pipe.
• CVE-2003-1035: User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.
Related
Attack pattern · CAPEC (2)
Observed example · CVE (7)
- CVE-2003-1035 The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to… vulnerability
- CVE-2003-0304 one||zero (aka One or Zero) Helpdesk 1.4 rc4 allows remote attackers to create administrator accounts by directly calling the install.php… vulnerability
- CVE-2002-0870 The original patch for the Cisco Content Service Switch 11000 Series authentication bypass vulnerability (CVE-2001-0622) was incomplete,… vulnerability
- CVE-2002-0066 Funk Software Proxy Host 3.x before 3.09A creates a Named Pipe that does not require authentication and is installed with insecure access… vulnerability
- CVE-2000-1179 Netopia ISDN Router 650-ST before 4.3.5 allows remote attackers to read system logs without authentication by directly connecting to the… vulnerability
- CVE-1999-1077 Idle locking function in MacOS 9 allows local attackers to bypass the password protection of idled sessions via the programmer's switch or… vulnerability
- CVE-1999-1454 Macromedia "The Matrix" screen saver on Windows 95 with the "Password protected" option enabled allows attackers with physical access to… vulnerability
Child of · CWE (2)
Peer of · CWE (1)
- CWE-420 Unprotected Alternate Channel weakness
Referenced by CAPEC · weakness (2)
Referenced by CVE · weakness (719)
- CVE-2026-118681 go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context… vulnerability
- CVE-2026-63190 FearlessCMS is a flat-file `content` management system centered on simplicity and open source. vulnerability
- CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally… vulnerability
- CVE-2026-93866 An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote,… vulnerability
- CVE-2026-107656 An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0… vulnerability
- CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS… vulnerability
- CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. vulnerability
- CVE-2026-79844 Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary… vulnerability
- CVE-2026-79850 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication… vulnerability
- CVE-2026-79855 An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing… vulnerability
- CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification… vulnerability
- CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for Drupal allows… vulnerability
- CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows Authentication Bypass. vulnerability
- CVE-2026-111438 在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求… vulnerability
- CVE-2026-111712 Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected… vulnerability
- CVE-2026-89057 A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain… vulnerability
- CVE-2026-19863 An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the… vulnerability
- CVE-2026-110852 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution… vulnerability
- CVE-2026-89067 Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. vulnerability
- CVE-2026-110130 Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a… vulnerability
- CVE-2026-11731 An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to… vulnerability
- CVE-2026-83787 Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. vulnerability
- CVE-2026-85865 Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. vulnerability
- CVE-2026-19620 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. vulnerability
- CVE-2026-19622 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper… vulnerability
- CVE-2026-84360 Nginx UI is a web user interface for the Nginx web server. vulnerability
- CVE-2026-62038 Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions. vulnerability
- CVE-2026-93949 Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows… vulnerability
- CVE-2026-106601 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery… vulnerability
- CVE-2026-106602 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery… vulnerability