A web server allows to use HTTP methods like DAMN, FUCC, PASTA with the same effect as a GET request: for example executing GET /this.txt brings to the same result as PIZZA /this.txt.
Is authentication bypass the only way to exploit them?
Just because the server treats arbitrary HTTP methods like GET, does not mean that it is exploitable in the first place.
First, there must be something relevant to security in the first place which is potentially exploitable, like access to restricted information, execution of commands on the server etc. None of this is known here.
Then it must be possible to work around restrictions intended to protect the server against such exploit, like authentication, IDS, WAF etc. Given that this is about using a different method, these restrictions must rely on specific methods and must fail open on other methods or on invalid syntax or similar. None of this is known either.
In other words: it is impossible to say based on the provided information if anything can be exploited in your case and how it can be exploited.
