CWE-288 · Authentication
Authentication Bypass Using an Alternate Path or Channel
749CVEs
20exploited
24with a public check
7likely (EPSS 10%+)
SortMost likely exploited
749 CVEs with CWE-288 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-42793In CISA KEVExploitedJetBrains TeamCity < 2023.05.4 - Remote Code ExecutionJetBrains · TeamCity · CVSS 9.8 · 2023-09-19 | 9.8 | 100% | 2023-09-19 |
| CVE-2024-1709In CISA KEVExploitedConnectWise ScreenConnect 23.9.7 - Authentication BypassConnectWise · ScreenConnect · CVSS 10 · 2024-02-21 | 10.0 | 100% | 2024-02-21 |
| CVE-2024-27198In CISA KEVExploitedTeamCity < 2023.11.4 - Authentication BypassJetBrains · TeamCity · CVSS 9.8 · 2024-03-04 | 9.8 | 100% | 2024-03-04 |
| CVE-2025-4427In CISA KEVExploitedIvanti Endpoint Manager Mobile - Unauthenticated Remote Code ExecutionIvanti · Endpoint Manager Mobile · CVSS 5.3 · 2025-05-13 | 5.3 | 100% | 2025-05-13 |
| CVE-2025-2747In CISA KEVExploitedKentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)Kentico · Xperience · CVSS 9.8 · 2025-03-24 | 9.8 | 97% | 2025-03-24 |
| CVE-2023-46747In CISA KEVExploitedF5 BIG-IP - Unauthenticated RCE via AJP SmugglingF5 · BIG-IP · CVSS 9.8 · 2023-10-26 | 9.8 | 97% | 2023-10-26 |
| CVE-2026-23760In CISA KEVExploitedSmarterTools SmarterMail - Admin Password ResetSmarterTools · SmarterMail · CVSS 9.3 · 2026-01-22 | 9.3 | 96% | 2026-01-22 |
| CVE-2024-55591In CISA KEVExploitedFortinet - Authentication BypassFortinet · FortiOS · CVSS 9.6 · 2025-01-14 | 9.6 | 94% | 2025-01-14 |
| CVE-2020-10148In CISA KEVExploitedSolarWinds Orion API - Auth BypassSolarWinds · Orion Platform · CVSS 9.8 · 2020-12-29 | 9.8 | 92% | 2020-12-29 |
| CVE-2026-20079In CISA KEVExploitedCisco Secure Firewall Management Center - Authentication BypassCisco · Cisco Secure Firewall Management Center (FMC) · CVSS 10 · 2026-03-04 | 10.0 | 89% | 2026-03-04 |
| CVE-2026-1603In CISA KEVExploitedIvanti Endpoint Manager - Authentication BypassIvanti · Endpoint Manager · CVSS 8.6 · 2026-02-10 | 8.6 | 88% | 2026-02-10 |
| CVE-2026-24858In CISA KEVExploitedAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9,…Fortinet · FortiWeb · CVSS 9.4 · 2026-01-27 | 9.4 | 87% | 2026-01-27 |
| CVE-2025-34026In CISA KEVExploitedVersa Concerto Actuator Endpoint - Authentication BypassVersa · Concerto · CVSS 9.2 · 2025-05-21 | 9.2 | 82% | 2025-05-21 |
| CVE-2025-2746In CISA KEVExploitedKentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0011)Kentico · Xperience · CVSS 9.8 · 2025-03-24 | 9.8 | 74% | 2025-03-24 |
| CVE-2026-18556In CISA KEVExploitedUnauthenticated administrative account takeoverN-able · N-central · CVSS 8.2 · 2026-08-01 | 8.2 | 44% | 2026-08-01 |
| CVE-2026-19490In CISA KEVExploitedNetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490NetScaler · ADC · CVSS 9.3 · 2026-08-19 | 9.3 | 33% | 2026-08-19 |
| CVE-2023-20269In CISA KEVExploitedA vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticat…Cisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 5 · 2023-09-06 | 5.0 | 27% | 2023-09-06 |
| CVE-2026-18577In CISA KEVExploitedN-able N-central < 2026.3.1.10 - Authentication BypassN-able · N-central · CVSS 8.2 · 2026-08-02 | 8.2 | 15% | 2026-08-02 |
| CVE-2026-116606In CISA KEVExploitedBarracuda Email Security Gateway - Authentication BypassBarracuda Networks · Barracuda Email Security Gateway (ESG) · CVSS 9.3 · 2026-11-02 | 9.3 | 11% | 2026-11-02 |
| CVE-2025-24472In CISA KEVExploitedAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.1…Fortinet · FortiOS · CVSS 8.1 · 2025-02-11 | 8.1 | 7.2% | 2025-02-11 |
| CVE-2024-10924CheckReally Simple Security < 9.1.2 - Authentication BypassReally Simple Plugins · Really Simple Security Pro multisite · CVSS 9.8 · 2024-11-15 | 9.8 | 82% | 2024-11-15 |
| CVE-2024-56325CheckApache Pinot < 1.3.0 - Authentication BypassApache Software Foundation · Apache Pinot · CVSS 9.8 · 2025-04-01 | 9.8 | 80% | 2025-04-01 |
| CVE-2023-2732CheckMStore API <= 3.9.2 - Authentication Bypassinspireui · MStore API – Create Native Android & iOS Apps On The Cloud · CVSS 9.8 · 2023-05-25 | 9.8 | 67% | 2023-05-25 |
| CVE-2024-23917CheckJetBrains TeamCity > 2023.11.3 - Authentication BypassJetBrains · TeamCity · CVSS 9.8 · 2024-02-06 | 9.8 | 54% | 2024-02-06 |
| CVE-2024-7314CheckAJ-Report < 1.4.1 - Remote Code Executionanji-plus · AJ-Report · CVSS 9.8 · 2024-08-02 | 9.8 | 52% | 2024-08-02 |
| CVE-2024-33610CheckSharp Multifunction Printers - Cookie ExposureSharp Corporation · Multiple MFPs (multifunction printers) · CVSS 9.1 · 2024-11-26 | 9.1 | 50% | 2024-11-26 |
| CVE-2023-2982CheckMiniorange Social Login and Register <= 7.6.3 - Authentication Bypasscyberlord92 · miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) · CVSS 9.8 · 2023-06-29 | 9.8 | 46% | 2023-06-29 |
| CVE-2024-10081CheckCodeChecker <= 6.24.1 - Authentication BypassEricsson · CodeChecker · CVSS 10 · 2024-11-06 | 10.0 | 40% | 2024-11-06 |
| CVE-2022-25369CheckDynamicweb 9.5.0 - 9.12.7 Unauthenticated Admin User CreationNo vendor recorded · CVSS 9.8 · 2026-01-23 | 9.8 | 40% | 2026-01-23 |
| CVE-2025-34143CheckETQ Reliance - Authentication Bypass via Trailing SpaceETQ · Reliance CG (legacy) · CVSS 9.3 · 2025-07-22 | 9.3 | 38% | 2025-07-22 |
| CVE-2025-69985CheckFUXA <= 1.2.8 - Authentication Bypass to Remote Code ExecutionFrangoteam · Fuxa · CVSS 9.8 · 2026-02-24 | 9.8 | 14% | 2026-02-24 |
| CVE-2020-27866CheckNETGEAR - Authentication BypassNETGEAR · Multiple Routers · CVSS 8.8 · 2021-02-11 | 8.8 | 8.7% | 2021-02-11 |
| CVE-2024-50477CheckWordPress Stacks Mobile App Builder <=5.2.3 - Authentication BypassStacks · Stacks Mobile App Builder · CVSS 9.8 · 2024-10-28 | 9.8 | 8.1% | 2024-10-28 |
| CVE-2024-9989CheckCrypto <= 2.15 - Authentication Bypassodude · Crypto Tool · CVSS 9.8 · 2024-10-29 | 9.8 | 7.1% | 2024-10-29 |
| CVE-2023-2437CheckUserPro <= 5.1.1 - Authentication BypassUserproplugin · UserPro - Community and User Profile WordPress Plugin · CVSS 9.8 · 2023-11-22 | 9.8 | 6.7% | 2023-11-22 |
| CVE-2023-2734CheckMStore API <= 3.9.1 - Authentication Bypassinspireui · MStore API – Create Native Android & iOS Apps On The Cloud · CVSS 9.8 · 2023-05-25 | 9.8 | 3.8% | 2023-05-25 |
| CVE-2025-0674CheckElber ESE DVB-S/S2 - Authentication BypassElber · Signum DVB-S/S2 IRD · CVSS 9.8 · 2025-02-06 | 9.8 | 3.6% | 2025-02-06 |
| CVE-2023-3277CheckMStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalationinspireui · MStore API – Create Native Android & iOS Apps On The Cloud · CVSS 9.8 · 2023-11-03 | 9.8 | 3.4% | 2023-11-03 |
| CVE-2024-8943CheckLatePoint <= 5.0.12 - Authentication Bypasslatepoint · LatePoint Plugin · CVSS 9.8 · 2024-10-08 | 9.8 | 3.1% | 2024-10-08 |
| CVE-2026-28411CheckWeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()LabRedesCefetRJ · WeGIA · CVSS 9.8 · 2026-02-27 | 9.8 | 2.7% | 2026-02-27 |
| CVE-2026-24207CheckNVIDIA Triton Inference Server <= 26.02 - Authentication BypassNVIDIA · Triton Inference Server · CVSS 9.8 · 2026-05-20 | 9.8 | 2.6% | 2026-05-20 |
| CVE-2024-28200CheckN-able N-central < 2024.2 - Authentication Bypass DetectionN-able · N-central · CVSS 9.1 · 2024-07-01 | 9.1 | 1.9% | 2024-07-01 |
| CVE-2024-50334CheckScoold < 1.64.0 - Authentication BypassErudika · scoold · CVSS 8.7 · 2024-10-29 | 8.7 | 1.0% | 2024-10-29 |
| CVE-2024-33939CheckMasteriyo LMS <= 1.7.3 - Insecure Direct Object Referencemasteriyo · Masteriyo - LMS · CVSS 5.3 · 2025-05-19 | 5.3 | 0.9% | 2025-05-19 |
| CVE-2022-35869This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentication is not required…Inductive Automation · Ignition · CVSS 7.5 · 2022-07-25 | 7.5 | 60% | 2022-07-25 |
| CVE-2026-10523An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary adm…ivanti · Sentry · CVSS 9.9 · 2026-06-09 | 9.9 | 54% | 2026-06-09 |
| CVE-2017-5174An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing fi…Geutebruck · Geutebruck IP Cameras · 2017-05-19 | – | 52% | 2017-05-19 |
| CVE-2023-2986Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypasstychesoftwares · Abandoned Cart Lite for WooCommerce · CVSS 9.8 · 2023-06-08 | 9.8 | 43% | 2023-06-08 |
| CVE-2024-39309ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerabilityparse-community · parse-server · CVSS 9.8 · 2024-07-01 | 9.8 | 20% | 2024-07-01 |
| CVE-2024-2056Artica Proxy Loopback Services Remotely Accessible UnauthenticatedArtica Tech · Artica Proxy · CVSS 9.8 · 2024-03-05 | 9.8 | 17% | 2024-03-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.