CWE-288

Authentication Bypass Using an Alternate Path or Channel
AI Translation Available

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Status
incomplete
Abstraction
base
Not Technology-Specific Web Based

Common Consequences

access control
Impacts
bypass protection mechanism

Potential Mitigations

Phases:
architecture and design
Descriptions:
• Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.