CWE-288 · Authentication Bypass Using an Alternate Path or Channel (page 2)

Page 2 of 7 — CVEs classified under CWE-288, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-288 — newest first (page 2 of 7)
CVESeverityScorePublishedSummary
CVE-2026-48020Critical10.02026-06-23Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middle…
CVE-2026-56243High8.12026-06-23Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header desp…
CVE-2020-37255High7.52026-06-20WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by se…
CVE-2019-25763Critical9.82026-06-20WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by explo…
CVE-2026-50194High8.22026-06-17Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints…
CVE-2026-54817Medium6.52026-06-17Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MSt…
CVE-2026-54804High7.62026-06-17Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
CVE-2026-49767Critical9.82026-06-17Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.
CVE-2026-49071Medium6.52026-06-17Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions.
CVE-2026-42629High8.82026-06-17Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
CVE-2026-25439High8.12026-06-17Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.
CVE-2026-122252026-06-16syracom AG Secure Login (2FA) for Atlassian Jira, Confluence, and Bitbucket 3.4.0.x contains an authentication bypass vulnerability. An attacker with valid cre…
CVE-2026-49764Critical9.82026-06-15Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
CVE-2026-48970High8.12026-06-15Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.
CVE-2026-42668High7.52026-06-15Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.
CVE-2026-42411High8.12026-06-15Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.
CVE-2026-42378Medium6.52026-06-15Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.
CVE-2026-40799Medium5.32026-06-15Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.
CVE-2026-40790Medium6.52026-06-15Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.
CVE-2026-40785High7.12026-06-15Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.
CVE-2026-40781High7.52026-06-15Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.
CVE-2026-39450High7.12026-06-15Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.
CVE-2026-49062High8.82026-06-15Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.J…
CVE-2026-47200Medium5.32026-06-12Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server…
CVE-2026-10523Critical9.92026-06-09An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to…
CVE-2026-5415High8.82026-06-05The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication…
CVE-2026-36175Medium6.82026-06-04An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the b…
CVE-2026-42654High7.12026-06-02Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This…
CVE-2026-40780High7.52026-06-02Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affe…
CVE-2026-455772026-05-29Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when…
CVE-2025-41273Critical9.82026-05-29Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in…
CVE-2026-8697High8.82026-05-28Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts a…
CVE-2026-89902026-05-28A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owne…
CVE-2026-350902026-05-27In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a…
CVE-2026-350872026-05-27Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the app…
CVE-2026-42760High7.52026-05-27Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recover…
CVE-2026-42749High7.12026-05-27Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows…
CVE-2026-42745High7.32026-05-27Authentication Bypass Using an Alternate Path or Channel vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Authentication Bypa…
CVE-2026-42735High8.22026-05-27Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exp…
CVE-2025-68711Low2.42026-05-26AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN…
CVE-2025-68708Low2.42026-05-26SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an…
CVE-2025-68710Low2.42026-05-26Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock…
CVE-2026-45217Medium6.52026-05-25Authentication Bypass Using an Alternate Path or Channel vulnerability in ThemeHigh Stripe Payment Gateway for WooCommerce allows Password Recovery Exploitatio…
CVE-2026-33843Critical9.12026-05-22Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a n…
CVE-2026-8598Critical9.12026-05-20An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical…
CVE-2026-24207Critical9.82026-05-20NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability migh…
CVE-2026-24206High7.32026-05-20NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability migh…
CVE-2026-43202026-05-18Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unauthorized access to protected features by manipulating the HT…
CVE-2026-4524Medium6.52026-05-14GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9.1 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have…
CVE-2026-45109High7.52026-05-13Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-…
CVE-2026-44575High7.52026-05-13Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middlewar…
CVE-2026-44574High8.12026-05-13Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protec…
CVE-2026-40621Critical9.82026-05-13ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authenticatio…
CVE-2026-423032026-05-12Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplic…
CVE-2026-423002026-05-12DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HT…
CVE-2026-35422Medium6.52026-05-12Authentication bypass using an alternate path or channel in Windows TCP/IP allows an authorized attacker to bypass a security feature over a network.
CVE-2026-8321High7.32026-05-11A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the file agents-api/src/middleware/runAuth.t…
CVE-2026-41308Medium6.52026-05-08Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS Pa…
CVE-2026-7458Critical9.82026-05-02The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.46. This is due to t…
CVE-2026-7567Critical9.82026-05-01The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation…
CVE-2026-40022High8.22026-04-27When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path su…
CVE-2026-40630Critical9.82026-04-24A vulnerability in  SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control e…
CVE-2026-41059High8.22026-04-22OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-dependent authenticatio…
CVE-2026-6771Critical9.82026-04-21Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6768Critical9.82026-04-21Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-6760Critical9.82026-04-21Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-405822026-04-18ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password…
CVE-2026-3605High8.12026-04-17An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, re…
CVE-2026-3324High8.22026-04-16Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
CVE-2026-3461Critical9.82026-04-15The Visa Acceptance Solutions plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.1.0. This is due to the `expr…
CVE-2026-35664Medium5.32026-04-10OpenClaw before 2026.3.25 contains an authentication bypass vulnerability in raw card send surface that allows unpaired recipients to mint legacy callback payl…
CVE-2026-35661Medium5.32026-04-10OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows attackers to mutate session state with…
CVE-2026-35654Medium5.32026-04-10OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Microsoft Teams feedback invokes that allows unauthorized senders to record session…
CVE-2026-35647Medium5.32026-04-10OpenClaw before 2026.3.25 contains an access control vulnerability where verification notices bypass DM policy checks and reply to unpaired peers. Attackers ca…
CVE-2026-35642Medium4.32026-04-09OpenClaw before 2026.3.25 contains an authorization bypass vulnerability where group reaction events bypass the requireMention access control mechanism. Attack…
CVE-2026-35634Medium5.12026-04-09OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-dir…
CVE-2026-31271Critical9.82026-04-07megagao production_ssm v1.0 contains an authorization bypass vulnerability in the user addition functionality. The insert() method in UserController.java lacks…
CVE-2026-30079Critical9.82026-04-07In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. This allows authentication to be b…
CVE-2026-31151Critical9.82026-04-06An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the application 's resources.
CVE-2026-5557Medium6.32026-04-05A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the componen…
CVE-2026-34581High8.12026-04-02goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited s…
CVE-2024-44286High7.52026-04-02This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard even…
CVE-2026-33950Critical9.42026-04-02Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by…
CVE-2026-29139Critical9.82026-04-02SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account initialization to reset a victim account password.
CVE-2026-34372Low2.72026-03-31Sulu is an open-source PHP content management system based on the Symfony framework. From versions 1.0.0 to before 2.6.22, and 3.0.0 to before 3.0.5, a user wh…
CVE-2026-34040High8.82026-03-31Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization p…
CVE-2026-32678High7.52026-03-27Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authenticatio…
CVE-2026-3531Medium6.52026-03-26Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect / OAuth client allows Authentication Bypass.This issue affects…
CVE-2026-2745Medium6.82026-03-25GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have all…
CVE-2026-27049Critical9.82026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobic…
CVE-2026-25406High8.12026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor…
CVE-2026-25357High8.12026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro allows Authentication Abuse.Th…
CVE-2026-25035Critical9.82026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Au…
CVE-2026-25002High7.52026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in ThimPress LearnPress – Sepay Payment learnpress-sepay-payment allows Authentication A…
CVE-2026-24359High8.82026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Dokan, Inc. Dokan dokan-lite allows Authentication Abuse.This issue affects Dokan: fr…
CVE-2026-3214Medium6.52026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass.This issue affects CAPTCHA: from 0.0.0 bef…
CVE-2026-1917Medium4.32026-03-25Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Login Disable allows Functionality Bypass.This issue affects Login Disable: fr…
CVE-2026-33315Medium4.32026-03-24Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in t…
CVE-2026-4700Critical9.82026-03-24Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-23480High8.82026-03-23Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability. The upsertUser endpoint has 3 issues…