Cyber Resilience

CWE · MITRE source

CWE-288Authentication Bypass Using an Alternate Path or Channel

Abstraction: Base · CVEs in our corpus: 643

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Last updated: 22 August 2026 14:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 9 mapping(s) from 5 framework(s): STIG rhel 7 3 (mostly) · STIG oracle linux 9 2 (full) · STIG oracle linux 8 2 (mostly) · CAPEC 1 (partial) · ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A07:2025 Authentication Failures.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • IA-10 Adaptive Authentication
  • IA-13 Identity Providers and Authorization Servers
  • IA-8 Identification and Authentication (Non-organizational Users)
  • AC-17 Remote Access
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 7 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V6.6.1
  • V12.1.3

NIST 800-53 r5 controls that address this weakness (6)AI-assisted

Control Title Family Why it addresses this CWE
IA-10Adaptive AuthenticationIAAdaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.
IA-13Identity Providers and Authorization ServersIACentralized IdPs close alternate authentication paths that enable bypass.
IA-8Identification and Authentication (Non-organizational Users)IAEnforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.
AC-17Remote AccessACAuthorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.
AC-9Previous Logon NotificationACUsers can identify logons via alternate paths or channels by reviewing the previous logon time.
SC-11Trusted PathSCRequires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1211 Exploitation for Stealth←P →MT1542.002 Component Firmware→P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2024-1709 KEV 10.010.00.99962024-02-21
CVE-2020-10148 KEV 9.99.80.91982020-12-29
CVE-2023-42793 KEV 9.99.80.99982023-09-19
CVE-2023-46747 KEV 9.99.80.96512023-10-26
CVE-2024-27198 KEV 9.99.80.99942024-03-04
CVE-2024-10924 9.99.80.82032024-11-15
CVE-2024-55591 KEV 9.99.80.98262025-01-14
CVE-2025-2746 KEV 9.99.80.59052025-03-24
CVE-2025-2747 KEV 9.99.80.92382025-03-24
CVE-2024-56325 9.99.80.78672025-04-01
CVE-2025-57819 KEV 9.99.80.88272025-08-28
CVE-2026-23760 KEV 9.99.80.96272026-01-22
CVE-2026-24858 KEV 9.99.80.85842026-01-27
CVE-2023-2732 9.89.80.67512023-05-25
CVE-2022-35869 9.69.80.60292022-07-25
CVE-2017-5174 9.49.80.52292017-05-19
CVE-2024-23917 9.49.80.53732024-02-06
CVE-2024-7314 9.49.80.51472024-08-02
CVE-2023-2986 9.29.80.42812023-06-08
CVE-2023-2982 9.29.80.46242023-06-29
CVE-2024-10081 9.110.00.39122024-11-06
CVE-2022-25369 9.19.80.40742026-01-23
CVE-2026-20079 9.110.00.37672026-03-04
CVE-2026-10523 9.09.90.51872026-06-09
CVE-2024-33610 8.89.10.45842024-11-26