Authentication bypass
A flaw that lets an attacker get past a login screen without a valid password.
Authentication is the check that you are who you say you are. A bypass skips it. The attacker reaches the inside of the system as if they had logged in, sometimes as an administrator.
Bypasses in firewalls, VPNs and remote access tools are especially valuable to attackers, because those devices sit on the internet and guard the rest of the network.
Why it matters to you: If your firewall, VPN or remote support tool has an exploited authentication bypass, assume someone may already have tried it. Update, then check the vendor's advice for signs of compromise.
Related terms
- Remote code execution (RCE)A flaw that lets an attacker run their own commands on your computer or server from somewhere else, often over the internet.
- Zero-dayA security hole that attackers found and used before the software's maker had a fix ready.
- CISA's Known Exploited Vulnerabilities catalog (KEV)The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.