CWE-420: Unprotected Alternate Channel

Base

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

Consequences

Access Control: Gain Privileges or Assume Identity, Bypass Protection Mechanism

How to prevent it

Architecture and Design: Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.

Recent advisories

GHSA-wxxx-gvqv-xp7p — LiteLLM has a sandbox escape in custom-code guardrail
CVE-2025-54309 — CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers…
GHSA-xwgj-vpm9-q2rq — Vulnerable juju introspection abstract UNIX domain socket
CVE-2023-20198 — Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.
GHSA-232p-vwff-86mp — Docker Swarm encrypted overlay network may be unauthenticated
GHSA-6wrf-mxfj-pf5p — Docker Swarm encrypted overlay network with a single endpoint is unauthenticated
GHSA-wqv3-8cm6-h6wg — Improper Authentication in Kubernetes

All advisories for CWE-420

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor