CWE-288 · Authentication Bypass Using an Alternate Path or Channel (page 4)
Page 4 of 7 — CVEs classified under CWE-288, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10653 | High | 8.6 | 2025-10-02 | An unauthenticated debug port may allow access to the device file system. |
CVE-2025-22862 | Medium | 6.7 | 2025-10-02 | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and… |
CVE-2025-61733 | High | 7.5 | 2025-10-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are… |
CVE-2025-10538 | | 2025-10-01 | An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor to gain access to ca… | |
CVE-2025-7038 | High | 8.2 | 2025-09-30 | The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the la… |
CVE-2025-5955 | High | 8.1 | 2025-09-19 | The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugi… |
CVE-2023-49564 | High | 8.8 | 2025-09-18 | The CBIS/NCS Manager API is vulnerable to an authentication bypass. By sending a specially crafted HTTP header, an unauthenticated user can gain unauthorized a… |
CVE-2025-10531 | Medium | 5.4 | 2025-09-16 | Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-8359 | Critical | 9.8 | 2025-09-06 | The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. This is due to the plugin not properly ver… |
CVE-2025-57819 | Critical | 9.8 | 2025-08-28 | FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied dat… |
CVE-2025-54738 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Job… |
CVE-2025-54725 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through… |
CVE-2025-34520 | Critical | 9.8 | 2025-08-27 | An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected func… |
CVE-2025-5821 | Critical | 9.8 | 2025-08-23 | The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not prop… |
CVE-2025-5060 | High | 8.1 | 2025-08-23 | The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly… |
CVE-2025-7642 | Critical | 9.8 | 2025-08-23 | The Simpler Checkout plugin for WordPress is vulnerable to Authentication Bypass in versions 0.7.0 to 1.1.9. This is due to the plugin not properly verifying a… |
CVE-2025-55623 | Medium | 5.4 | 2025-08-22 | An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge). |
CVE-2025-50904 | Critical | 9.8 | 2025-08-20 | There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /… |
CVE-2025-27129 | Critical | 9.8 | 2025-08-20 | An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can le… |
CVE-2025-24496 | High | 7.5 | 2025-08-20 | An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. Specially crafted network packets c… |
CVE-2025-54713 | Critical | 9.8 | 2025-08-20 | Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows… |
CVE-2025-52338 | Medium | 5.3 | 2025-08-19 | An issue in the default configuration of the password reset function in LogicData eCommerce Framework v5.0.9.7000 allows attackers to bypass authentication and… |
CVE-2025-3639 | | 2025-08-18 | Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… | |
CVE-2025-8995 | Critical | 9.8 | 2025-08-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authentica… |
CVE-2025-51452 | Critical | 9.8 | 2025-08-13 | In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2024-26009 | High | 8.1 | 2025-08-12 | An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, For… |
CVE-2025-40761 | High | 7.6 | 2025-08-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDC… |
CVE-2025-40743 | High | 8.3 | 2025-08-12 | A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All… |
CVE-2025-55012 | | 2025-08-11 | Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing… | |
CVE-2025-53187 | Critical | 9.8 | 2025-08-11 | Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to byp… |
CVE-2025-24000 | High | 8.8 | 2025-08-07 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post S… |
CVE-2025-44957 | High | 8.5 | 2025-08-04 | Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. |
CVE-2025-7710 | Critical | 9.8 | 2025-08-02 | The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the p… |
CVE-2025-6895 | Critical | 9.8 | 2025-07-26 | The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token(… |
CVE-2025-7742 | | 2025-07-25 | An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the dev… | |
CVE-2025-31512 | High | 7.3 | 2025-07-22 | An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access reques… |
CVE-2025-34143 | | 2025-07-22 | An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user… | |
CVE-2025-7692 | High | 8.1 | 2025-07-22 | The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olws_handl… |
CVE-2025-7444 | Critical | 9.8 | 2025-07-18 | The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verific… |
CVE-2025-1313 | High | 8.8 | 2025-07-12 | The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6… |
CVE-2025-30026 | Critical | 9.8 | 2025-07-11 | The AXIS Camera Station Server had a flaw that allowed to bypass authentication that is normally required. |
CVE-2025-24332 | High | 7.1 | 2025-07-02 | Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband sy… |
CVE-2025-53099 | High | 7.5 | 2025-07-01 | Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered… |
CVE-2025-25171 | High | 8.8 | 2025-06-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Convers Lab WP SmartPay smartpay allows Authentication Abuse.This issue affects WP Sm… |
CVE-2025-6688 | Critical | 9.8 | 2025-06-27 | The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a u… |
CVE-2025-6675 | Medium | 4.8 | 2025-06-26 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-6556 | Medium | 5.4 | 2025-06-24 | Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2025-32976 | High | 8.8 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-5820 | High | 8.8 | 2025-06-21 | Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on af… |
CVE-2025-51381 | Critical | 9.8 | 2025-06-18 | An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this vulnerability is exploited, an attacker may bypass the authentication of… |
CVE-2025-49125 | High | 7.5 | 2025-06-16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the ro… |
CVE-2025-4973 | Critical | 9.8 | 2025-06-12 | The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to… |
CVE-2025-30184 | Critical | 9.8 | 2025-06-09 | CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path. |
CVE-2025-31022 | Critical | 9.8 | 2025-06-09 | Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU… |
CVE-2025-31019 | High | 8.8 | 2025-06-09 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abus… |
CVE-2025-48904 | Medium | 4.4 | 2025-06-06 | Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-4797 | Critical | 9.8 | 2025-06-03 | The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and includin… |
CVE-2025-5190 | High | 8.8 | 2025-05-30 | The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect authentication checki… |
CVE-2025-4687 | | 2025-05-29 | In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the invite functionality. If a victim has a p… | |
CVE-2025-48926 | Medium | 4.3 | 2025-05-28 | The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers. |
CVE-2025-47461 | High | 8.8 | 2025-05-23 | Authentication Bypass Using an Alternate Path or Channel vulnerability in mediaticus Subaccounts for WooCommerce subaccounts-for-woocommerce allows Authenticat… |
CVE-2025-34026 | High | 7.5 | 2025-05-21 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to… |
CVE-2025-46412 | Critical | 9.8 | 2025-05-21 | Affected Vertiv products do not properly protect webserver functions that could allow an attacker to bypass authentication. |
CVE-2025-48011 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-48010 | Medium | 4.8 | 2025-05-21 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Pass… |
CVE-2025-47941 | High | 7.2 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS… |
CVE-2024-33939 | Medium | 5.3 | 2025-05-19 | Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - L… |
CVE-2025-47710 | High | 7.4 | 2025-05-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-47707 | High | 7.5 | 2025-05-14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affect… |
CVE-2025-3932 | Medium | 6.5 | 2025-05-14 | It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accesse… |
CVE-2025-4427 | Medium | 5.3 | 2025-05-13 | An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without prope… |
CVE-2025-22462 | Critical | 9.8 | 2025-05-13 | An authentication bypass in Ivanti Neurons for ITSM (on-prem only) before 2023.4, 2024.2 and 2024.3 with the May 2025 Security Patch allows a remote unauthenti… |
CVE-2025-40581 | High | 7.1 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affect… |
CVE-2025-0549 | Medium | 6.8 | 2025-05-09 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.3 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17… |
CVE-2025-3844 | Critical | 9.8 | 2025-05-07 | The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Authentication Bypass in versions 1.9.1 to 7.5.2. This is due to handel_ajax_req(… |
CVE-2024-12225 | Critical | 9.1 | 2025-05-06 | A vulnerability was found in Quarkus in the quarkus-security-webauthn module. The Quarkus WebAuthn module publishes default REST endpoints for registering and… |
CVE-2025-45607 | Critical | 9.8 | 2025-05-05 | An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request. |
CVE-2025-1909 | Critical | 9.8 | 2025-05-05 | The BuddyBoss Platform Pro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.01. This is due to insufficient ve… |
CVE-2025-47244 | High | 7.3 | 2025-05-03 | Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of… |
CVE-2025-24206 | High | 7.7 | 2025-04-29 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS… |
CVE-2025-2492 | | 2025-04-18 | An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthoriz… | |
CVE-2024-42178 | Low | 2.5 | 2025-04-17 | HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential… |
CVE-2025-39535 | High | 7.2 | 2025-04-17 | Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: f… |
CVE-2025-32357 | Medium | 4.3 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they h… |
CVE-2024-13553 | Critical | 9.8 | 2025-04-01 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and incl… |
CVE-2024-56325 | Critical | 9.8 | 2025-04-01 | Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -… |
CVE-2025-31095 | Critical | 9.8 | 2025-04-01 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Hossein Material Dashboard material-dashboard allows Authentication Bypass.This issue… |
CVE-2025-22277 | High | 8.8 | 2025-04-01 | Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: f… |
CVE-2025-24095 | High | 7.6 | 2025-03-31 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4. An app may be able to bypass Privac… |
CVE-2025-31694 | High | 8.1 | 2025-03-31 | Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): fr… |
CVE-2025-22230 | High | 7.8 | 2025-03-25 | VMware Tools for Windows contains an authentication bypass vulnerability due to improper access control. A malicious actor with non-administrative privileges o… |
CVE-2025-2747 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server… |
CVE-2025-2746 | Critical | 9.8 | 2025-03-24 | An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server password handling of empty SHA1 usernames… |
CVE-2025-30112 | High | 7.1 | 2025-03-24 | On 70mai Dash Cam 1S devices, by connecting directly to the dashcam's network and accessing the API on port 80 and RTSP on port 554, an attacker can bypass the… |
CVE-2024-13442 | Critical | 9.8 | 2025-03-19 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.0. This is… |
CVE-2024-13772 | Medium | 5.6 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-13771 | Critical | 9.8 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including… |
CVE-2024-11286 | Critical | 9.8 | 2025-03-14 | The WP JobHunt plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.1. This is due to the plugin not properly ve… |
CVE-2025-2080 | | 2025-03-13 | Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow… | |
CVE-2025-29996 | | 2025-03-13 | This vulnerability exists in the CAP back office application due to improper implementation of OTP verification mechanism in its API based login. A remote atta… |