CWE-289
Authentication Bypass by Alternate Name
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
We have discovered 24,892 live websites that are affected by CWE-289.
CVEs
- Count - 6
CWE References
Website Distribution by Country
Number of websites using CWE-289 United States | 5,593 websites |
 Switzerland | 2,425 websites |
 Italy | 1,791 websites |
 Japan | 1,709 websites |
 Germany | 1,701 websites |
 Korea, South | 1,642 websites |
 Canada | 999 websites |
 France | 861 websites |
 Spain | 763 websites |
Website Distribution by TLD
Number of websites using CWE-289| .com | 8,747 websites |
| .ch | 2,329 websites |
| .org | 1,781 websites |
| .it | 1,401 websites |
| .de | 1,072 websites |
| .net | 972 websites |
| .ca | 435 websites |
| .es | 407 websites |
| .jp | 400 websites |
| .fr | 381 websites |
Newest CVEs
List of the most recent CVEs that are part of CWE-289| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Aug, 2026 | CVE-2026-32639 | Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads | 1 |
| Aug, 2026 | CVE-2026-8457 | WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT | 510 |
| Jul, 2026 | CVE-2026-10842 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability | 5 |
| Jul, 2026 | CVE-2026-9701 | Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation | 231 |
| Jun, 2026 | CVE-2026-56091 | Apache Shiro: Authentication bypass in Guice-Web integration | 15,112 |
| Jun, 2024 | CVE-2024-2098 | Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary | 9,036 |
The most widespread CVEs
List of the most common CVEs that are part of CWE-289| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Jun, 2026 | CVE-2026-56091 | Apache Shiro: Authentication bypass in Guice-Web integration | 15,112 |
| Jun, 2024 | CVE-2024-2098 | Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary | 9,036 |
| Aug, 2026 | CVE-2026-8457 | WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT | 510 |
| Jul, 2026 | CVE-2026-9701 | Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation | 231 |
| Jul, 2026 | CVE-2026-10842 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability | 5 |
| Aug, 2026 | CVE-2026-32639 | Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads | 1 |
Websites affected by CWE-289
Top websites that are affected by CWE-289. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ******.***.org | United States | *,*** | |
| ********.org | Germany | *,*** | |
| ****************.ch | Switzerland | *,*** | |
| ****.edu | United States | **,*** | |
| ***********.com |  Netherlands | **,*** | |
| ********.********.edu | United States | **,*** | |
| ****.********.org | France | **,*** | |
| ****.****.***.edu | United States | **,*** | |
| ****.****.edu | United States | **,*** | |
| *******.org | United States | **,*** |