CWE-288Authentication Bypass Using an Alternate Path or Channel

Description

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Common consequences

• Access Control→Bypass Protection Mechanism

Potential mitigations

• Architecture and Design
  Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Related CWEs

Recent CVEs classified under this CWE