A flaw in PortSwigger Burp Suite DAST before version 2026.8 allows an attacker to bypass authentication by taking advantage of an alternate path or channel. The vulnerability is classified as CWE-288, meaning attackers can exploit a weakness in authentication sequences to gain unauthorized access to the platform’s administrative or testing controls. If exploited, attackers could potentially access sensitive configuration data, initiate scans on client applications, or perform actions that should be restricted to privileged users, undermining both confidentiality and integrity of the testing infrastructure.

The issue affects PortSwigger’s Burp Suite DAST (formerly Burp Suite Enterprise Edition) with any release prior to 2026.8. Systems running older versions are vulnerable until they are updated to 2026.8 or later, which contains the fix for the authentication bypass. No other products are explicitly mentioned as affected.

The CVSS score of 9.2 indicates a high severity, with the vulnerability providing a complete bypass of authentication controls. EPSS is 0.0033 (less than 1%), indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting that large‑scale exploitation data is limited. The likely attack vector involves interaction with the DAST service through an alternate channel, which could be remote if the service is exposed to the internet or internal attackers have network access. Given the high score and the functional nature of the bypass, organizations should consider the risk high and take remedial action promptly.