CWE-288 — Authentication Bypass Using an Alternate Path or Channel
CWE-288: Authentication Bypass Using an Alternate Path or Channel
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Common consequences
- Access Control: Bypass Protection Mechanism
Mitigations
Architecture and Design — Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
References
- CWE page: https://cwe.mitre.org/data/definitions/288.html
- CWE list: https://cwe.mitre.org/data/index.html
See all 1,245 pages under Weakness classes (CWE) →
Related pages
Browse by topic
Every page in the corpus, grouped. Search finds one page; this shows what else is here.