CWE-288: Authentication Bypass Using an Alternate Path or Channel

Code Examples & CVEs

Demonstrative Examples

Register SECURE_ME is located at address 0xF00. A mirror of this register called COPY_OF_SECURE_ME is at location 0x800F00. The register SECURE_ME is protected from malicious agents and only allows access to select, while COPY_OF_SECURE_ME is not. Access control is implemented using an allowlist (as indicated by acl_oh_allowlist). The identity of the initiator of the transaction is indicated by the one hot input, incoming_id. This is checked against the acl_oh_allowlist (which contains a list of initiators that are allowed to access the asset). Though this example is shown in Verilog, it will apply to VHDL as well.

The bugged line of code is repeated in the Bad example above. Weakness arises from the fact that the SECURE_ME register can be modified by writing to the shadow register COPY_OF_SECURE_ME, the address of COPY_OF_SECURE_ME should also be included in the check. That buggy line of code should instead be replaced as shown in the Good Code Snippet below.

BadVerilog

assign addr_auth = (address == 32'hF00) ? 1: 0;

GoodVerilog

assign addr_auth = (address == 32'hF00 || address == 32'h800F00) ? 1: 0;

Observed CVE Examples (7)

CVE-2000-1179

Router allows remote attackers to read system logs without authentication by directly connecting to the login screen and typing certain control characters.

View Details

CVE-1999-1454

Attackers with physical access to the machine may bypass the password prompt by pressing the ESC (Escape) key.

View Details

CVE-1999-1077

OS allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.

View Details

CVE-2003-0304

Direct request of installation file allows attacker to create administrator accounts.

View Details

CVE-2002-0870

Attackers may gain additional privileges by directly requesting the web management URL.

View Details

CVE-2002-0066

Bypass authentication via direct request to named pipe.

View Details

CVE-2003-1035

User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine analysis methods around the CWE-288 resource boundary

MITRE identifies manual analysis, automated static analysis, dynamic analysis as applicable detection approaches. Use them to enumerate every route, protocol, recovery flow, trusted header, and administrative channel that can create or upgrade an authenticated session, then compare its checks with the primary login path. Require a reproducible trace from attacker influence to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.

CWE-288: detection methods and operational guidance — MITRE CWE

Centralize authentication across primary and alternate channels

Route browser, API, mobile, SSO, recovery, bootstrap, and administrative authentication through one maintained policy enforcement layer. Require complete credential and protocol validation before session creation, reject identity asserted only by client-controlled headers, rotate sessions after authentication, and remove legacy paths that cannot meet the same assurance level as the primary channel.

Authentication Cheat Sheet — OWASP Foundation

Apply lessons from CVE-2025-2746 in Kentico Xperience CMS

NVD maps CVE-2025-2746 to CWE-288; an alternate authentication path could allow an attacker to control administrative objects. Use the case to test administrative APIs directly, require equivalent checks on alternate routes, and verify a forged or incomplete authentication state cannot reach object-management functions.

CVE-2025-2746 Detail — NIST National Vulnerability Database

Verify every authentication path against OWASP ASVS

Use the ASVS authentication requirements as a route-by-route verification matrix. Map each endpoint that issues, refreshes, recovers, or elevates credentials to an explicit requirement and test result. Include non-browser protocols, support tooling, remembered devices, federation callbacks, and failure recovery so an unlisted alternate path cannot inherit trust without the required authentication ceremony.

OWASP Application Security Verification Standard — OWASP Foundation

Test authentication through every alternate path and recovery channel

Inventory primary login, API, single-sign-on, recovery, fallback, and administrative authentication paths and require the same server-side identity guarantees on each. Use a vetted authentication system, multifactor authentication where appropriate, generic failure responses, attack throttling, and secure session replacement and invalidation. Add direct tests proving an alternate route cannot recognize an invalid user as legitimate.

A07:2025 Authentication Failures — OWASP Foundation

Frequently Asked Questions

What is CWE-288: Authentication Bypass Using an Alternate Path or Channel?+

CWE-288: Authentication Bypass Using an Alternate Path or Channel is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product requires authentication, but the product has an alternate path or channel that does not require authentication.

What are the security consequences of Authentication Bypass Using an Alternate Path or Channel?+

If exploited, CWE-288 (Authentication Bypass Using an Alternate Path or Channel) it can compromise Access Control, leading to outcomes such as Bypass Protection Mechanism.

How do you prevent or mitigate Authentication Bypass Using an Alternate Path or Channel?+

Recommended mitigations for CWE-288 include: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Which programming languages are affected by Authentication Bypass Using an Alternate Path or Channel?+

CWE-288 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Authentication Bypass Using an Alternate Path or Channel?+

MITRE documents real CVEs mapped to CWE-288, including CVE-2000-1179, CVE-1999-1454, CVE-1999-1077, CVE-2003-0304 and CVE-2002-0870. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-288 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (7)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Combine analysis methods around the CWE-288 resource boundary

Centralize authentication across primary and alternate channels

Apply lessons from CVE-2025-2746 in Kentico Xperience CMS

Verify every authentication path against OWASP ASVS

Test authentication through every alternate path and recovery channel

Frequently Asked Questions

Learn More