PortSwigger Burp Suite DAST before version 2026.8 contains an authentication bypass vulnerability (CWE-288) that can be exploited via an alternate path or channel. This allows unauthenticated attackers to circumvent authentication controls, potentially gaining unauthorized access. The vulnerability has a CVSS 4.0 base score of 9.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The affected versions are from 2021.11 up to but excluding 2026.8.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms in Burp Suite DAST, leading to unauthorized access to the application. This could compromise sensitive data, affect system integrity, and disrupt availability. The high CVSS score indicates critical risk if exploited.

A fix is available in Burp Suite DAST version 2026.8 and later. Users should upgrade to version 2026.8 or newer to remediate this vulnerability. Since this is not a cloud service, remediation depends on user action to apply the update. No additional mitigation guidance is provided in the vendor advisory.