Weakness (CWE)
CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
More detail
Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
How to prevent it (2 mitigations)
-
Architecture and Design
Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
-
Architecture and Design
Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
Source: MITRE CWE-294
109 results · Clear filters · Feed
-
High 7.4
Microsoft.Data.SqlClient Information Disclosure Vulnerability
Authentication bypass by capture-replay in SQL Server allows an unauthorized attacker to disclose information over a network.
-
High 8.9
Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory c…
-
High 7.4
SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseTo. In the SP-initiat…
-
High 7.4
WPO365 LOGIN before 45.2 SAML Replay Protection Bypass
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to th…
-
High 7.6
A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-t…
-
High 7.5
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to ca…
-
High 8.8
Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured …
-
High 7.4
OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their ow…
-
High 7.4
Stackrox: stackrox: saml response replay allows multiple central authentication tokens
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML re…
-
High 7.5
MOVEit Transfer OIDC Authentication Replay Vulnerability
Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
-
High 8.8
1732E ArmorBlock® - Multiple Vulnerabilities
A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of device configuration.
-
High 8.1
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigge…
-
High 7.7
Apache Roller: WSSE digest authentication headers can be replayed
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or time…
-
High 8.1
Botslab G980H Dashcams Authentication Bypass by Capture-replay
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication v…
-
High 7.5
CVE-2026-75907
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to …
-
High 8.2
mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and sc…
-
High 8.1
http4k: `DigestAuthProvider.verify` did not bind to request URI
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An…
-
High 7.0
Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent re…
-
High 7.4
Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an a…
-
High 8.7
Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational cac…
-
High 7.4
Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability
Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
Windows Kerberos Remote Code Execution Vulnerability
Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.
-
High 7.4CVE-2026-73312 Public exploit
XenForo < 2.3.13 Refresh Token Replay via Expired Access Token
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit th…
-
High 7.4CVE-2026-73311 Public exploit
XenForo < 2.3.13 OAuth2 Authorization Code Reuse
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization …
-
High 7.4
Rancher: SAML Assertion Replay
A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability …
-
High 7.5
Nimiq: Validity store off by one error
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_vali…
-
High 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker…
-
High 7.5
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker…
-
High 7.4
Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing …
-
High 8.7
On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely…
-
High 8.2
Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific cha…
-
High 7.4
phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, all…
-
High 7.7
BetterDesk has a replay behavior vulnerability when devices are deleted
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha cont…
-
High 8.1
Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within Facebook…
-
High 8.1
IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.
-
High 8.8
Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and a…
-
High 8.0CVE-2026-62911 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
IdP-initiated SAML sessions not reliably invalidated (replay)
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.
-
High 8.2
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gai…
-
High 8.1
Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking
Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence o…