Security Resilience

CWE · MITRE source

CWE-288Authentication Bypass Using an Alternate Path or Channel

Abstraction: Base · CVEs in our corpus: 704

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Last updated: 16 October 2026 07:24 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 8 mapping(s) from 4 framework(s): STIG rhel 7 3 (mostly) · STIG oracle linux 9 2 (full) · STIG oracle linux 8 2 (mostly) · ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • IA-10 Adaptive Authentication
  • IA-13 Identity Providers and Authorization Servers
  • IA-8 Identification and Authentication (Non-organizational Users)
  • AC-17 Remote Access
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 7 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V6.6.1
  • V12.1.3

NIST 800-53 r5 controls PROPOSED for this weakness (6)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control Title Family Why it addresses this CWE
IA-10Adaptive AuthenticationIAAdaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.
IA-13Identity Providers and Authorization ServersIACentralized IdPs close alternate authentication paths that enable bypass.
IA-8Identification and Authentication (Non-organizational Users)IAEnforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.
AC-17Remote AccessACAuthorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.
AC-9Previous Logon NotificationACUsers can identify logons via alternate paths or channels by reviewing the previous logon time.
SC-11Trusted PathSCRequires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-1709 KEV 10.010.00.99982024-02-21
CVE-2026-20079 KEV 10.010.00.88182026-03-04
CVE-2020-10148 KEV 9.99.80.91982020-12-29
CVE-2023-42793 KEV 9.99.80.99992023-09-19
CVE-2023-46747 KEV 9.99.80.96512023-10-26
CVE-2024-27198 KEV 9.99.80.99942024-03-04
CVE-2024-10924 9.99.80.82222024-11-15
CVE-2024-55591 KEV 9.99.80.94152025-01-14
CVE-2025-2746 KEV 9.99.80.73632025-03-24
CVE-2025-2747 KEV 9.99.80.97172025-03-24
CVE-2024-56325 9.99.80.80212025-04-01
CVE-2025-57819 KEV 9.99.80.86352025-08-28
CVE-2026-23760 KEV 9.99.80.96542026-01-22
CVE-2026-24858 KEV 9.99.80.85802026-01-27
CVE-2026-19490 KEV 9.99.80.23162026-08-19
CVE-2023-2732 9.79.80.67282023-05-25
CVE-2022-35869 9.69.80.59902022-07-25
CVE-2017-5174 9.49.80.52292017-05-19
CVE-2024-23917 9.49.80.54012024-02-06
CVE-2024-7314 9.49.80.51752024-08-02
CVE-2023-2986 9.29.80.42542023-06-08
CVE-2023-2982 9.29.80.46242023-06-29
CVE-2024-10081 9.110.00.39922024-11-06
CVE-2022-25369 9.19.80.40012026-01-23
CVE-2026-10523 9.19.90.53142026-06-09