The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Primary

Architecture and Design
COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Architecture and Design
This is often seen in web applications that assume that access to a particular CGI program can only be obtained through a "front" screen, when the supporting programs are directly accessible. But this problem is not just in web apps.

Access Control
Bypass Protection Mechanism

Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Register SECURE_ME is located at address 0xF00. A
mirror of this register called COPY_OF_SECURE_ME is
at location 0x800F00. The register SECURE_ME is
protected from malicious agents and only allows
access to select, while COPY_OF_SECURE_ME is not.

Access control is implemented using an allowlist (as
indicated by acl_oh_allowlist). The identity of the
initiator of the transaction is indicated by the
one hot input, incoming_id. This is checked against
the acl_oh_allowlist (which contains a list of
initiators that are allowed to access the asset).

Though this example is shown in Verilog, it will
apply to VHDL as well.

module foo_bar(data_out, data_in, incoming_id, address, clk, rst_n);
output [31:0] data_out;
input [31:0] data_in, incoming_id, address;
input clk, rst_n;
wire write_auth, addr_auth;
reg [31:0] data_out, acl_oh_allowlist, q;
assign write_auth = | (incoming_id & acl_oh_allowlist) ? 1 : 0;
always @*

acl_oh_allowlist <= 32'h8312;

assign addr_auth = (address == 32'hF00) ? 1: 0;
always @ (posedge clk or negedge rst_n)

if (!rst_n)

begin

q <= 32'h0;
data_out <= 32'h0;

end

else

begin

q <= (addr_auth & write_auth) ? data_in: q;
data_out <= q;

end

end

endmodule

assign addr_auth = (address == 32'hF00) ? 1: 0;
The bugged line of code is repeated in the Bad
example above. Weakness arises from the fact that the
SECURE_ME register can be modified by writing to the
shadow register COPY_OF_SECURE_ME, the address of
COPY_OF_SECURE_ME should also be included in the check.
That buggy line of code should instead be replaced as
shown in the Good Code Snippet below.

assign addr_auth = (address == 32'hF00 || address == 32'h800F00) ? 1: 0;

CVE-2000-1179
Router allows remote attackers to read system logs without authentication by directly connecting to the login screen and typing certain control characters.
https://www.cve.org/CVERecord?id=CVE-2000-1179

CVE-1999-1454
Attackers with physical access to the machine may bypass the password prompt by pressing the ESC (Escape) key.
https://www.cve.org/CVERecord?id=CVE-1999-1454

CVE-1999-1077
OS allows local attackers to bypass the password protection of idled sessions via the programmer's switch or CMD-PWR keyboard sequence, which brings up a debugger that the attacker can use to disable the lock.
https://www.cve.org/CVERecord?id=CVE-1999-1077

CVE-2003-0304
Direct request of installation file allows attacker to create administrator accounts.
https://www.cve.org/CVERecord?id=CVE-2003-0304

CVE-2002-0870
Attackers may gain additional privileges by directly requesting the web management URL.
https://www.cve.org/CVERecord?id=CVE-2002-0870

CVE-2002-0066
Bypass authentication via direct request to named pipe.
https://www.cve.org/CVERecord?id=CVE-2002-0066

CVE-2003-1035
User can avoid lockouts by using an API instead of the GUI to conduct brute force password guessing.
https://www.cve.org/CVERecord?id=CVE-2003-1035

Authentication Bypass by Alternate Path/Channel

A10
Failure to Restrict URL Access
CWE More Specific

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

overlaps Unprotected Alternate Channel

PLOVER
2006-07-19
Draft 3
2006-07-19

CWE Content Team
MITRE
2008-09-08
updated Description, Modes_of_Introduction, Name, Relationships, Observed_Example, Relationship_Notes, Taxonomy_Mappings, Type

CWE Content Team
MITRE
2008-11-24
updated Observed_Examples

CWE Content Team
MITRE
2011-03-29
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples

CWE Content Team
MITRE
2024-11-19
4.16
2024-11-19
updated Description, Diagram

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships, Weakness_Ordinalities

Abhi Balakrishnan
2024-09-29
4.16
2024-11-19
Contributed usability diagram concepts used by the CWE team

Authentication Bypass by Alternate Path/Channel