Weakness · High
CWE-288: Authentication Bypass Using an Alternate Path or Channel
What it is
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design
- Exploited in the wild
- 21 known exploited CVEs
What an attacker can do
- Bypass Protection Mechanism (Access Control)
How to prevent it
Architecture and Design
- Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Exploited in the wild: 21 CVEs
Vulnerabilities caused by CWE-288 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.
- CVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability · added September 9, 2026
- CVE-2026-19490Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability · added September 9, 2026
- CVE-2026-18556N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · added August 4, 2026
- CVE-2026-18577N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · added August 3, 2026
- CVE-2026-1603Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability · added March 9, 2026
- CVE-2026-24858Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability · added January 27, 2026
- CVE-2026-23760 ransomwareSmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability · added January 26, 2026
- CVE-2025-34026Versa Concerto Improper Authentication Vulnerability · added January 22, 2026
- CVE-2025-2747Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability · added October 20, 2025
- CVE-2025-2746Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability · added October 20, 2025
- CVE-2025-57819Sangoma FreePBX Authentication Bypass Vulnerability · added August 29, 2025
- CVE-2025-4427Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass Vulnerability · added May 19, 2025
- CVE-2025-24472 ransomwareFortinet FortiOS and FortiProxy Authentication Bypass Vulnerability · added March 18, 2025
- CVE-2024-55591 ransomwareFortinet FortiOS and FortiProxy Authentication Bypass Vulnerability · added January 14, 2025
- CVE-2024-27198 ransomwareJetBrains TeamCity Authentication Bypass Vulnerability · added March 7, 2024
- CVE-2024-1709 ransomwareConnectWise ScreenConnect Authentication Bypass Vulnerability · added February 22, 2024
- CVE-2023-46747 ransomwareF5 BIG-IP Configuration Utility Authentication Bypass Vulnerability · added October 31, 2023
- CVE-2023-42793 ransomwareJetBrains TeamCity Authentication Bypass Vulnerability · added October 4, 2023
- CVE-2023-20269 ransomwareCisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability · added September 13, 2023
- CVE-2022-40684 ransomwareFortinet Multiple Products Authentication Bypass Vulnerability · added October 11, 2022
- CVE-2020-10148SolarWinds Orion Authentication Bypass Vulnerability · added November 3, 2021
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.