CVE-2026-90481
Received Received - Intake

Authentication Bypass in PortSwigger Burp Suite DAST

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-90481
EUVD
EUVD-2026-86005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
portswigger burp_suite_dast to 2026.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in PortSwigger Burp Suite DAST versions before 2026.8. It allows unauthorized access via an alternate path or channel, potentially enabling attackers to bypass authentication mechanisms.

Detection Guidance

Detecting this vulnerability requires checking the version of Burp Suite DAST running on your system. Compare the installed version against 2026.8 or later. If your version is prior to 2026.8, the system is vulnerable. Use commands like 'burp-dast --version' or check the application's 'About' section for version details.

Impact Analysis

The vulnerability could allow attackers to gain unauthorized access to sensitive data or systems protected by Burp Suite DAST. This may lead to data breaches, unauthorized actions, or further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized access to personal or sensitive data. Organizations may face legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Burp Suite DAST to version 2026.8 or later immediately. Download the update from the official PortSwigger website and follow the installation instructions for your platform. Ensure no critical scans are running during the upgrade to avoid disruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90481. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart