Skip to content
Log inStart free trial

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Base

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Consequences

  • Access Control: Bypass Protection Mechanism

How to prevent it

  • Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Recent advisories

  • GHSA-vc32-4gwf-77xp — Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
  • GHSA-hxcx-9h4f-42xx — Snipe-IT: 2FA bypass via the API token flow
  • GHSA-pf83-w3f9-8m37 — n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
  • GHSA-p68q-wchp-6fh7 — fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
  • CVE-2026-19490 — Vulnerability in NetScaler ADC and NetScaler Gateway.
  • GHSA-7j72-f6wg-cxw6 — SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
  • CVE-2026-18577 — An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
  • CVE-2026-18556 — Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass.
  • GO-2026-6207 — Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass
  • GHSA-9cr8-q42q-g8m7 — Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
  • GHSA-5r4w-85f3-pw66 — Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
  • GHSA-xf64-8mw2-4gr2 — Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization
  • GHSA-hg3f-28rg-4jxj — Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
  • GHSA-26hh-7cqf-hhc6 — Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
  • GHSA-267c-6grr-h53f — Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

All advisories for CWE-288

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor