CWE-288 · Authentication Bypass Using an Alternate Path or Channel (page 3)
Page 3 of 7 — CVEs classified under CWE-288, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67282 | Medium | 5.4 | 2026-01-09 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Authorization Bypass vulnerabilities exists which allow a low privileged user to download password hashes of… |
CVE-2025-67915 | High | 8.8 | 2026-01-08 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics… |
CVE-2025-23504 | Critical | 9.8 | 2026-01-08 | Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affe… |
CVE-2026-21411 | High | 8.8 | 2026-01-06 | Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and chang… |
CVE-2025-3652 | Medium | 5.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to private audio reco… |
CVE-2025-64121 | Critical | 9.8 | 2026-01-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue… |
CVE-2025-68620 | Critical | 9.1 | 2026-01-01 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to stea… |
CVE-2025-15102 | Critical | 9.1 | 2025-12-30 | DVP-12SE11T - Password Protection Bypass |
CVE-2025-68860 | Critical | 9.8 | 2025-12-29 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Mobile Builder Mobile builder mobile-builder allows Authentication Abuse.This issue a… |
CVE-2025-64236 | Critical | 9.8 | 2025-12-18 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a bef… |
CVE-2025-14714 | Medium | 6.5 | 2025-12-15 | An Authentication Bypass vulnerability existed where the application bundled an interpreter (Python) that inherits the Transparency, Consent, and Control (TCC)… |
CVE-2025-11984 | Medium | 6.8 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow… |
CVE-2025-67507 | High | 8.1 | 2025-12-10 | Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery… |
CVE-2025-66200 | Medium | 5.4 | 2025-12-05 | mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can… |
CVE-2025-66238 | High | 7.2 | 2025-12-04 | DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual console could exploit th… |
CVE-2025-13539 | Critical | 9.8 | 2025-11-27 | The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not p… |
CVE-2025-10571 | Critical | 9.6 | 2025-11-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1. |
CVE-2025-63217 | Critical | 9.8 | 2025-11-18 | The Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT t… |
CVE-2025-12760 | Medium | 5.4 | 2025-11-18 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0… |
CVE-2025-64530 | High | 7.5 | 2025-11-13 | Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logi… |
CVE-2025-59367 | Critical | 9.8 | 2025-11-13 | An authentication bypass vulnerability has been identified in certain DSL series routers, may allow remote attackers to gain unauthorized access into the affec… |
CVE-2025-64281 | Critical | 9.8 | 2025-11-12 | An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials. |
CVE-2025-13018 | High | 8.1 | 2025-11-11 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. |
CVE-2025-13013 | Medium | 6.1 | 2025-11-11 | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and T… |
CVE-2025-12445 | Medium | 6.5 | 2025-11-10 | Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-ori… |
CVE-2025-12431 | Medium | 6.5 | 2025-11-10 | Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2025-64173 | High | 7.5 | 2025-11-06 | Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well a… |
CVE-2025-62064 | Critical | 9.8 | 2025-11-06 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This is… |
CVE-2025-59392 | Medium | 6.8 | 2025-11-06 | On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (containing a publicly… |
CVE-2025-43436 | High | 7.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, wa… |
CVE-2025-43422 | Medium | 4.6 | 2025-11-04 | The issue was addressed by adding additional logic. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker with physical access to a device may be able t… |
CVE-2025-5397 | Critical | 9.8 | 2025-10-31 | The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.1. This is due to the check_login() fun… |
CVE-2025-12466 | High | 7.5 | 2025-10-30 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue… |
CVE-2025-9313 | | 2025-10-28 | An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the database by leveraging… | |
CVE-2025-11621 | High | 8.1 | 2025-10-23 | Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the sam… |
CVE-2025-60041 | High | 8.8 | 2025-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.T… |
CVE-2025-49901 | Critical | 9.8 | 2025-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Authentication Abu… |
CVE-2025-11534 | | 2025-10-21 | The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access with… | |
CVE-2025-58133 | Medium | 5.3 | 2025-10-15 | Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network acce… |
CVE-2025-9967 | Critical | 9.8 | 2025-10-15 | The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. Thi… |
CVE-2025-10294 | Critical | 9.8 | 2025-10-15 | The OwnID Passwordless Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.4. This is due to the plugin… |
CVE-2025-55338 | Medium | 6.1 | 2025-10-14 | Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-8093 | High | 8.8 | 2025-10-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-11522 | Critical | 9.8 | 2025-10-09 | The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and includin… |
CVE-2025-34251 | | 2025-10-07 | Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as… | |
CVE-2025-9914 | Medium | 4.3 | 2025-10-06 | The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access… |
CVE-2025-61673 | High | 8.6 | 2025-10-03 | Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when confi… |
CVE-2025-6388 | Critical | 9.8 | 2025-10-03 | The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.2.14. This is due to the custom_action… |
CVE-2025-10653 | High | 8.6 | 2025-10-02 | An unauthenticated debug port may allow access to the device file system. |
CVE-2025-22862 | Medium | 6.7 | 2025-10-02 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and… |
CVE-2025-61733 | High | 7.5 | 2025-10-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are… |
CVE-2025-10538 | | 2025-10-01 | An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor to gain access to ca… | |
CVE-2025-7038 | High | 8.2 | 2025-09-30 | The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the la… |
CVE-2025-5955 | High | 8.1 | 2025-09-19 | The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugi… |
CVE-2023-49564 | High | 8.8 | 2025-09-18 | The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized a… |
CVE-2025-10531 | Medium | 5.4 | 2025-09-16 | Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-8359 | Critical | 9.8 | 2025-09-06 | The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly ver… |
CVE-2025-57819 | Critical | 9.8 | 2025-08-28 | FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied dat… |
CVE-2025-54738 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Job… |
CVE-2025-54725 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through… |
CVE-2025-34520 | Critical | 9.8 | 2025-08-27 | An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected func… |
CVE-2025-5821 | Critical | 9.8 | 2025-08-23 | The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not prop… |
CVE-2025-5060 | High | 8.1 | 2025-08-23 | The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly… |
CVE-2025-7642 | Critical | 9.8 | 2025-08-23 | The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a… |
CVE-2025-55623 | Medium | 5.4 | 2025-08-22 | An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge). |
CVE-2025-50904 | Critical | 9.8 | 2025-08-20 | There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /… |
CVE-2025-27129 | Critical | 9.8 | 2025-08-20 | An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can le… |
CVE-2025-24496 | High | 7.5 | 2025-08-20 | An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets c… |
CVE-2025-54713 | Critical | 9.8 | 2025-08-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows… |
CVE-2025-52338 | Medium | 5.3 | 2025-08-19 | An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and… |
CVE-2025-3639 | | 2025-08-18 | Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… | |
CVE-2025-8995 | Critical | 9.8 | 2025-08-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-51452 | Critical | 9.8 | 2025-08-13 | In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2024-26009 | High | 8.1 | 2025-08-12 | An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, For… |
CVE-2025-40761 | High | 7.6 | 2025-08-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDC… |
CVE-2025-40743 | High | 8.3 | 2025-08-12 | A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All… |
CVE-2025-55012 | | 2025-08-11 | Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing… | |
CVE-2025-53187 | Critical | 9.8 | 2025-08-11 | Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to byp… |
CVE-2025-24000 | High | 8.8 | 2025-08-07 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post S… |
CVE-2025-44957 | High | 8.5 | 2025-08-04 | Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. |
CVE-2025-7710 | Critical | 9.8 | 2025-08-02 | The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the p… |
CVE-2025-6895 | Critical | 9.8 | 2025-07-26 | The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token(… |
CVE-2025-7742 | | 2025-07-25 | An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the dev… | |
CVE-2025-31512 | High | 7.3 | 2025-07-22 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access reques… |
CVE-2025-34143 | | 2025-07-22 | An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user… | |
CVE-2025-7692 | High | 8.1 | 2025-07-22 | The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olws_handl… |
CVE-2025-7444 | Critical | 9.8 | 2025-07-18 | The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verific… |
CVE-2025-1313 | High | 8.8 | 2025-07-12 | The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6… |
CVE-2025-30026 | Critical | 9.8 | 2025-07-11 | The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. |
CVE-2025-24332 | High | 7.1 | 2025-07-02 | Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband sy… |
CVE-2025-53099 | High | 7.5 | 2025-07-01 | Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered… |
CVE-2025-25171 | High | 8.8 | 2025-06-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP Sm… |
CVE-2025-6688 | Critical | 9.8 | 2025-06-27 | The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a u… |
CVE-2025-6675 | Medium | 4.8 | 2025-06-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-6556 | Medium | 5.4 | 2025-06-24 | Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2025-32976 | High | 8.8 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-5820 | High | 8.8 | 2025-06-21 | Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on af… |
CVE-2025-51381 | Critical | 9.8 | 2025-06-18 | An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this vulnerability is exploited, an attacker may bypass the authentication of… |
CVE-2025-49125 | High | 7.5 | 2025-06-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the ro… |
CVE-2025-4973 | Critical | 9.8 | 2025-06-12 | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to… |