CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- apache software foundation ofbiz Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound 9.8 Critical
- gpustack GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover 9.1 Critical
- wpo365 | seamless wordpress + microsoft integration (wpo365 | login) WPO365 LOGIN before 45.2 SAML Replay Protection Bypass 9.1 Critical
- watchguard authpoint authentication gateway WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions 9.1 Critical
- watchguard fireware os Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service 6.0 Medium
- eaton easye4 Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated... 7.5 High
- esaqa gmbh psono WebAuthn assertion replay permits second-factor bypass in Psono Server 6.5 Medium
- yeswiki YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox 8.3 High
- siemens mendix saml (mendix 10 compatible), mendix saml (mendix 11 compatible), mendix saml (mendix 9 compatible) +2 more A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4)... 7.6 High
- grokability snipe-it Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition 8.7 High
- open-reception appointment-booking-software OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie 7.4 High
- authlib Authlib: ID token can disable its own nonce validation via the nonce_supported claim 4.2 Medium
- red hat advanced cluster security for kubernetes 4.10, advanced cluster security for kubernetes 4.11 +1 more Stackrox: stackrox: saml response replay allows multiple central authentication tokens 7.4 High
- error311 filerise FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay) 6.4 Medium
- ldapaccountmanager lam LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session 4.2 Medium
- progress moveit transfer MOVEit Transfer OIDC Authentication Replay Vulnerability 7.5 High
- rockwell automation 1732e armorblock® i/o 1732E ArmorBlock® - Multiple Vulnerabilities 8.8 High
- apache software foundation allura Apache Allura: Oauth1 Replay Attack 9.1 Critical
- devolutions server Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and... 6.8 Medium
- devolutions server Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and... 6.8 Medium
- apache http server Apache HTTP Server: mod_auth_digest one-time-nonce replay attack 8.1 High
- misp MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period 9.3 Critical
- apache software foundation roller Apache Roller: WSSE digest authentication headers can be replayed 7.7 High
- botslab g980h Botslab G980H Dashcams Authentication Bypass by Capture-replay 8.6 High
- norwegian cruise line door access control CVE-2026-75907 7.5 High
- zenhive mpp mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed 8.2 High
- mayswind ezbookkeeping mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack 7.6 High
- keycloak, red hat build of keycloak +1 more Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch 7.4 High
- arista networks eos On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitim… 5.3 Medium
- http4s Http4s: DigestAuth allows replay of captured requests 5.9 Medium
- geovision inc. gv-lpclpc2011/2211 GV-LPCLPC2011/2211 - ONVIF WS-Security PasswordDigest Replay 9.8 Critical
- drupal saml sso - service provider SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 3.1 Low
- macropay-solutions maravel-framework Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches 8.7 High
- microsoft authentication library, azure\/msal-node +1 more Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability 7.4 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows Kerberos Remote Code Execution Vulnerability 8.8 High
- xenforo XenForo < 2.3.13 Refresh Token Replay via Expired Access Token 9.1 Critical
- xenforo XenForo < 2.3.13 OAuth2 Authorization Code Reuse 9.1 Critical
-
libauthen-sasl-perlDebian,perl-authen-saslAlpaquita,rootio-libauthen-sasl-perlRoot +2 more Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step 9.8 Critical - suse rancher Rancher: SAML Assertion Replay 7.4 High
- openedx openedx-platform Open edX LTI OAuth Replay Attack 4.7 Medium
- grafana enterprise SAML assertion replay via skipped InResponseTo validation 6.8 Medium
- filamentphp filament Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used 6.5 Medium
- jeremyevans rodauth Rodauth before 2.47.0 TOTP Code Reuse via Drift Window 5.1 Medium
- zephyrproject zephyr Zephyr WireGuard mutates peer state before anti-replay check, enabling capture-replay endpoint hijack 6.5 Medium
- wpmu dev forminator WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability 5.3 Medium
- No product listed An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a... 7.5 High
- No product listed An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a... 7.5 High
- spring security, vmware spring security +1 more Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay 7.4 High
- dropbox samly Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions 9.1 Critical
- zenhive mpp, machine payments protocol +1 more On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay 8.7 High
- Show olderLoading…