CWE-288
Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
612 vulnerabilities with CWE-288
CVE-2026-44575
HIGH
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
CVSS 7.5
CVE-2026-44574
HIGH
Next.js: Middleware / Proxy bypass through dynamic route parameter injection
CVSS 8.1
CVE-2026-40621
CRITICAL
Elecom Co.,ltd. WRC-BE72XSD-B - Authentication Bypass Using an Alternate Path or Channel
CVSS 9.8
CVE-2026-42303
MEDIUM
Fides: Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
CVE-2026-42300
CRITICAL
DevGuard: Unauthenticated identity assertion via `X-Admin-Token` header
CVE-2026-35422
MEDIUM
Microsoft Windows 10 Version 1607 - Windows TCP/IP Driver Security Feature Bypass Vulnerability
CVSS 6.5
CVE-2026-8321
HIGH
inkeep agents runAuth Middleware runAuth.ts createDevContext authentication bypass
CVSS 7.3
CVE-2026-41308
MEDIUM
Password Pusher: JSON API `/p.json` file upload alias bypasses file-push authentication
CVSS 6.5
CVE-2026-7458
CRITICAL
User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint
CVSS 9.8
CVE-2026-7567
CRITICAL
Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover
CVSS 9.8
CVE-2026-40022
HIGH
Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime
CVSS 8.2
CVE-2026-40630
CRITICAL
SenseLive X3050 Authentication bypass using an alternate path or channel
CVSS 9.8
CVE-2026-41059
HIGH
OAuth2 Proxy 7.5.0-7.15.1 skip_auth Rules - Authentication Bypass
CVSS 8.2
CVE-2026-6771
CRITICAL
Mitigation bypass in the DOM: Security component
CVSS 9.8
CVE-2026-6768
CRITICAL
Mitigation bypass in the Networking: Cookies component
CVSS 9.8
CVE-2026-6760
CRITICAL
Mitigation bypass in the Networking: Cookies component
CVSS 9.8
CVE-2026-40582
CRITICAL
ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout
CVE-2026-3605
HIGH
Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-Service
CVSS 8.1
CVE-2026-3324
HIGH
ManageEngine Log360 13000-13013 - Authentication Bypass via Improper Filter Configuration
CVSS 8.2
CVE-2026-3461
CRITICAL
Visa Acceptance Solutions <= 2.1.0 - Unauthenticated Authentication Bypass via Billing Email
CVSS 9.8
CVE-2026-35664
MEDIUM
OpenClaw < 2026.3.25 - DM Pairing Bypass via Legacy Card Callbacks
CVSS 5.3
CVE-2026-35661
MEDIUM
OpenClaw < 2026.3.25 - Telegram DM-Scoped Inline Button Callback Authorization Bypass
CVSS 5.3
CVE-2026-35654
MEDIUM
OpenClaw < 2026.3.25 - Authorization Bypass in Microsoft Teams Feedback Invoke
CVSS 5.3
CVE-2026-35647
MEDIUM
OpenClaw < 2026.3.25 - Direct Message Policy Bypass via Verification Notices
CVSS 5.3
CVE-2026-35642
MEDIUM
OpenClaw < 2026.3.25 - Authorization Bypass in Group Reactions via requireMention Bypass
CVSS 4.3
Details
Vulnerabilities
612