CWE-288 Authentication Bypass Using an Alternate Path or Channel

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets

Snipe-IT: 2FA bypass via the API token flow

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

Duplicate Advisory: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization

Apache Pinot Vulnerable to Authentication Bypass

Moby has AuthZ plugin bypass when provided oversized request bodies

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement

Filament multi-factor authentication (app) recovery codes can be used multiple times

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection