CWE-288: Authentication Bypass Using an Alternate Path or Channel

What is CWE-288?

MITRE CWE

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Verify to analyze this CWE entry

A short verification protects the official data source and prevents automated AI abuse.

Official definition

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Detailed description

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Characteristics

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Modes of introduction

Architecture and Design: COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
Architecture and Design: This is often seen in web applications that assume that access to a particular CGI program can only be obtained through a "front" screen, when the supporting programs are directly accessible. But this problem is not just in web apps.

Common consequences

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Access Control
Bypass Protection Mechanism

Mitigations

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Architecture and DesignFunnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Detection methods

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

Representative vulnerabilities

CyStack is analyzing this CWE entry. The page will update automatically when the bilingual analysis is ready.

These examples illustrate this CWE entry and are not an exhaustive list of related vulnerabilities.

CVE-2000-1179Router allows remote attackers to read system logs without authentication by directly connecting to the login screen and typing certain control characters.
CVE-1999-1454Attackers with physical access to the machine may bypass the password prompt by pressing the ESC (Escape) key.
CVE-1999-1077OS allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.
CVE-2003-0304Direct request of installation file allows attacker to create administrator accounts.
CVE-2002-0870Attackers may gain additional privileges by directly requesting the web management URL.
CVE-2002-0066Bypass authentication via direct request to named pipe.
CVE-2003-1035User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.

Sources and references

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan