Authentication bypass in PortSwigger Burp Suite DAST
Priority MEDIUM 42CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.
Summary
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Fix Fixed Burp Suite DAST (PortSwigger): 2026.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PortSwigger | Burp Suite DAST | 2021.11 to before 2026.8 | 2026.8 | Patch available | CNA |
- Burp Suite DAST VendorPortSwigger Affected 2021.11 to before 2026.8 Fixed in 2026.8 Patch available CNA
Remediation
- Fix · CNA Burp Suite DAST (PortSwigger) Fixed in 2026.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-90481
- 2026-10-03 Alias added: GHSA-hmv3-x9c8-w9rm
References
More PortSwigger vulnerabilities
- TI-2018-01069 Improper certificate validation in Tenable Burp Suite Community Edition CVSS 3.0HIGH 7.4
- TI-2021-19920 PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file… CVSS 3.1MEDIUM 6.5
- TI-2021-10134 An issue was discovered in PortSwigger Burp Suite before 2021.2. CVSS 3.1MEDIUM 6.5
- TI-2018-07348 PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the… CVSS 3.0MEDIUM 5.9
- TI-2022-15982 A URL disclosure issue was discovered in Burp Suite before 2022.6. CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-90481 · CVE Program
- CVE-2026-90481 · NVD
- FIRST EPSS
- GHSA-hmv3-x9c8-w9rm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences