Authentication bypass vulnerabilities
A flaw lets an attacker skip the login step entirely or act as another user without their password.
Authentication bypass in numbers
sbomify tracks 12,705 authentication bypass vulnerabilities. Most are found in server software (34%), web application (31%) and network device (13%).
How to fix authentication bypass vulnerabilities
Upgrade, and rotate credentials and sessions that may have been exposed.
Most exploited authentication bypass vulnerabilities
- CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs
- CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
- CVE-2026-49869 Kestra OSS OS Command Injection
- CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass
- CVE-2026-20079 Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel
- CVE-2026-20127 Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass
- CVE-2025-57819 Sangoma FreePBX Authentication Bypass
- CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication
- CVE-2025-32433 Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function
- CVE-2024-54085 AMI MegaRAC SPx Authentication Bypass by Spoofing
- CVE-2024-51567 CyberPanel Incorrect Default Permissions
- CVE-2024-1709 ConnectWise ScreenConnect Authentication Bypass
Recently published
- CVE-2025-13173 Auth bypass in WSO2 API Control Plane
- CVE-2025-36069 TS4500 Tape Library Insufficient Session Expiration
- CVE-2025-36252 TS4500 Tape Library Insufficient Session Expiration
- CVE-2025-7043 Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
- CVE-2026-103314 Stackrox: stackrox: saml response replay allows multiple central authentication tokens
- CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.