CVE-2026-90481CWE-288

CVE-2026-90481

published September 24, 2026

CVSS
9.2
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00330 · 24.8th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-09-24T19:17Z
References (1)
https://portswigger.net/burp/releases/dast-2026-8 · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 14:14Z
    In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel
    cvelistv5