A security-feature bypass is a weakness that lets an attacker sidestep a protective control that should have blocked the action. The control may be authentication, authorization, input filtering, sandboxing, or another safeguard built into the product. Instead of breaking the whole system, the attacker finds a path around the check.
This matters because a bypass often turns a limited bug into a much bigger one. If a login check, permission check, or content filter can be skipped, an attacker may reach admin functions, read protected data, or chain the flaw with another issue for deeper compromise. In practice, bypasses appear through logic errors, alternate API routes, malformed requests, or inconsistent checks between components. Defenders reduce the risk by enforcing server-side validation, testing every access path, patching quickly, and logging suspicious requests that appear to evade normal controls.