An authentication bypass flaw in the Windows TCP/IP stack allows an authorized network user to route traffic through an alternate channel that is not properly validated by the operating system. This vulnerability, classified as CWE‑288, effectively circumvents a security feature that enforces authentication integrity, potentially enabling the attacker to gain unauthorized access or execute malicious code within the Windows environment.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and 23H2 Edition (Server Core).

The CVSS score of 6.5 indicates medium severity, but the EPSS score is unavailable so the current exploitation probability remains unclear. The vulnerability is not listed in the CISA KEV catalogue. Based on the description, the likely attack vector is a network‑based pathway where an authenticated user directs traffic through the alternate authentication channel; this requires valid credentials or existing network access and may provide a foothold for privilege escalation once the security feature is bypassed.