CWE-424: Improper Protection of Alternate Path

Class

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Consequences

Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

How to prevent it

Architecture and Design: Deploy different layers of protection to implement security in depth.

Recent advisories

EEF-CVE-2026-82586 — AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
EEF-CVE-2026-82754 — ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
GHSA-25gq-j9jx-43pg — Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
GHSA-263q-5cv3-xq9g — Gitea allows attackers to add attachments with forbidden file extensions
GHSA-ggwg-cmwp-46r5 — yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key

All advisories for CWE-424

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor