Weakness (CWE)
CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
More detail
Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
How to prevent it (2 mitigations)
-
Architecture and Design
Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
-
Architecture and Design
Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
Source: MITRE CWE-294
41 results · Clear filters · Feed
-
Critical 9.2
Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0:…
-
Critical 9.8
Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session …
-
Critical 9.1
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_…
-
Critical 9.1
WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disr…
-
Critical 9.1
Apache Allura: Oauth1 Replay Attack
OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.
-
Critical 9.3
MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow where a TOTP code is ver…
-
Critical 9.8
GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
-
Critical 9.8
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the …
-
Critical 9.8
Apache Tomcat: Limited replay attack possible with DIGEST authentication
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that …
-
Critical 9.1
Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assert…
-
Critical 9.8
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization c…
-
Critical 9.1
Boruta accepts expired JWT client assertions due to missing exp claim validation
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client …
-
Critical 9.8
Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to v…
-
Critical 9.1
MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentica…
-
Critical 9.1
Gitea OAuth2 authorization codes lack expiry and reuse enforcement
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
-
Critical 9.1
env-set cross-proxy Digest auth state leak
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Diges…
-
Critical 9.8
cross-origin Digest auth state leak
Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authori…
-
Critical 9.5
SAML Authentication Replay in Rancher
A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,
-
Critical 9.8
OpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation
OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead…
-
Critical —
mpp has multiple payment bypass and griefing vulnerabilities
### Impact Multiple vulnerabilities were discovered which allowed for undesirable behaviors, including: - Performing free `tempo/charge` requests - Replaying existing `tempo/charge` requests - Performing free `tempo/session` requests - Piggybacking off existi…
-
Critical —
mppx has multiple payment bypass and griefing vulnerabilities
### Impact Multiple vulnerabilities were discovered in `tempo/charge` and `tempo/session` which allowed for undesirable behaviors, including: - Replaying `tempo/charge` transaction hashes across push/pull modes, across charge/session endpoints, and via concur…
-
Critical 9.8
OpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing
OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scopes, including…
-
Critical 9.8
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access contr…
-
Critical 9.8
D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication cha…
-
Critical 10.0
Azure Bastion Elevation of Privilege Vulnerability
Azure Bastion Elevation of Privilege Vulnerability
-
Critical —
Taylored webhook validation vulnerabilities
### Critical Security Advisory for Taylored npm package v7.0.7 - tag 7.0.5 #### Summary A series of moderate to high-severity security vulnerabilities have been identified specifically in version **7.0.7 of \`taylored\`**. These vulnerabilities reside in the …
-
Critical 9.4
Autoeastern Smart Keyless Entry System Replay Attack
Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Soluto. Attack confirmed …
-
Critical 9.4
KIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack
Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack. Manufacture is unknow…
-
Critical 9.1CVE-2021-27289 Public exploit
A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v…
-
Critical 9.1
Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attack…
-
Critical 9.8
D-Link - CWE-294: Authentication Bypass by Capture-replay
D-Link - CWE-294: Authentication Bypass by Capture-replay
-
Critical 9.2
Replay Attack in KNX Secure Devices
Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
-
Critical 9.8
An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and acces…
-
Critical 9.8CVE-2023-49231 EPSS 43%
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to …
-
Critical 9.8
A remote authentication bypass issue exists in some OneView APIs.
-
Critical 9.1
Apache Linkis gateway module token authentication bypass
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version …
-
Critical 9.0
Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates informat…
-
Critical 9.8
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix …
-
Critical 9.8
Capture-replay in Gitea
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code.
-
Critical 9.8
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all …