What CVEs are caused by CWE-288?

664 recorded CVEs are attributed to CWE-288, including CVE-2026-20079, CVE-2025-57819, CVE-2025-4427. 19 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Is CWE-288 part of the OWASP Top 10?

CWE-288 maps to OWASP Top Ten 2007: Failure to Restrict URL Access (A10) in the OWASP security taxonomy.

What are the consequences of CWE-288?

Exploiting CWE-288 can lead to: Bypass Protection Mechanism.

Is CWE-288 actively exploited?

Yes. 19 CWE-288 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 664 recorded CVEs.

RadicalNotion.AI

Log in Create an account

Base weakness

Incomplete

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Q: How do you prevent CWE-288?

Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Last updated May 1, 2026

664

Recorded CVEs

With this primary weakness

19

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-288 (Authentication Bypass Using an Alternate Path or Channel) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

664 recorded CVEs are caused by CWE-288 (Authentication Bypass Using an Alternate Path or Channel), including 19 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 265 new CWE-288 CVEs have been recorded so far in 2026 (166 in 2025).

CVE-2025-4427

CISA KEV

Authentication Bypass

Critical · CVSS 10.0 · EPSS 100th

2025-05-13

CVE-2024-27198

CISA KEV

Critical · CVSS 10.0 · EPSS 100th

2024-03-04

CVE-2024-1709

CISA KEV

Authentication bypass using an alternate path or channel

Critical · CVSS 10.0 · EPSS 100th

2024-02-21

CVE-2026-19490

CISA KEV

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

Critical · CVSS 9.3 · EPSS 98th

2026-08-19

CVE-2026-1603

CISA KEV

Critical · CVSS 9.3 · EPSS 100th

2026-02-10

CVE-2026-24858

CISA KEV

Critical · CVSS 9.3 · EPSS 100th

2026-01-27

CVE-2026-23760

CISA KEV

SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API

Critical · CVSS 9.3 · EPSS 100th

2026-01-22

CVE-2025-2747

CISA KEV

Kentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication Bypass

Critical · CVSS 9.3 · EPSS 100th

2025-03-24

CVE-2025-2746

CISA KEV

Kentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication Bypass

Critical · CVSS 9.3 · EPSS 99th

2025-03-24

CVE-2024-55591

CISA KEV

Critical · CVSS 9.3 · EPSS 100th

2025-01-14

Showing 12 of 664 recorded CWE-288 CVEs. Get an alert for each new one, with AI-written analysis and fixes.

Monitor CWE-288 vulnerabilities

Common consequences

What can happen when CWE-288 is exploited.

Bypass Protection Mechanism

Affects: Access Control

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Architecture and Design

Applies to

Technologies

Web Based

How to prevent it

Practical mitigations for CWE-288, grouped by where in the lifecycle they apply.

Architecture and Design

Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Code examples

MITRE examples of the weakness in code.

Register SECURE_ME is located at address 0xF00. A mirror of this register called COPY_OF_SECURE_ME is at location 0x800F00. The register SECURE_ME is protected from malicious agents and only allows access to select, while COPY_OF_SECURE_ME is not.

Access control is implemented using an allowlist (as indicated by acl_oh_allowlist). The identity of the initiator of the transaction is indicated by the one hot input, incoming_id. This is checked against the acl_oh_allowlist (which contains a list of initiators that are allowed to access the asset).

Though this example is shown in Verilog, it will apply to VHDL as well.

The bugged line of code is repeated in the Bad example above. Weakness arises from the fact that the SECURE_ME register can be modified by writing to the shadow register COPY_OF_SECURE_ME, the address of COPY_OF_SECURE_ME should also be included in the check. That buggy line of code should instead be replaced as shown in the Good Code Snippet below.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2000-1179 — Router allows remote attackers to read system logs without authentication by directly connecting to the login screen and typing certain control characters.
CVE-1999-1454 — Attackers with physical access to the machine may bypass the password prompt by pressing the ESC (Escape) key.
CVE-1999-1077 — OS allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.
CVE-2003-0304 — Direct request of installation file allows attacker to create administrator accounts.
CVE-2002-0870 — Attackers may gain additional privileges by directly requesting the web management URL.
CVE-2002-0066 — Bypass authentication via direct request to named pipe.
CVE-2003-1035 — User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.

Terminology & mappings

Mapped taxonomies

PLOVER: Authentication Bypass by Alternate Path/Channel
OWASP Top Ten 2007: Failure to Restrict URL Access (A10) — CWE More Specific fit

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-288.

What is CWE-288?: The product requires authentication, but the product has an alternate path or channel that does not require authentication.
What CVEs are caused by CWE-288?: 664 recorded CVEs are attributed to CWE-288, including CVE-2026-20079, CVE-2025-57819, CVE-2025-4427. 19 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Is CWE-288 part of the OWASP Top 10?: CWE-288 maps to OWASP Top Ten 2007: Failure to Restrict URL Access (A10) in the OWASP security taxonomy.
How do you prevent CWE-288?: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
What are the consequences of CWE-288?: Exploiting CWE-288 can lead to: Bypass Protection Mechanism.
Is CWE-288 actively exploited?: Yes. 19 CWE-288 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 664 recorded CVEs.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Track CWE-288 CVEs

Get an alert when a new CWE-288 CVE affects your products, with AI-written analysis and remediation steps.

Create an account See pricing

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Peer

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Track CWE-288 CVEs