CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
github.com/arnika-project/arnikaGoarnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS6.3 Medium- open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 moreazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay8.1 High
- red hat enterprise linux 10, enterprise linux 9 +1 moreKeylime: keylime: security bypass due to hardcoded tpm quote nonce6.3 Medium
- curlcross-proxy Digest auth state leak5.3 Medium
- openclawOpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation9.2 Critical
- openairinterface oai-cn5g-amfOpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection....7.5 High
- openclawOpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encoding6.3 Medium
- openclawOpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypass2.3 Low
- openclawOpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replay6.3 Medium
- openclawOpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V38.2 High
mppcrates.iompp has multiple payment bypass and griefing vulnerabilities9.3 Criticalmppxnpmmppx has multiple payment bypass and griefing vulnerabilities9.3 Critical- wevm mppxmppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality7.5 High
- dovecot, open-xchange gmbh ox dovecot pro +1 moreDovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth...6.8 Medium
- openclawOpenClaw < 2026.3.23 - Replay Identity Drift via Query-Only Variants in Plivo V2 Verification8.3 High
- shenzhen hcc technology mpos m6 plusShenzhen HCC Technology MPOS M6 PLUS Bluetooth authentication replay2.3 Low
- openclawOpenClaw < 2026.3.13 - Bootstrap Setup Code Replay via Device Pairing9.3 Critical
- samsung smart switchAuthentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote...7.1 High
- abb awin gw100 rev.2, awin gw120 +1 moreAuthentication Bypass due to Improper Session Validation7.2 High
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force5.7 Medium
- openclawOpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression6.3 Medium
openclawnpmOpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity3.7 Low- openclawOpenClaw < 2026.2.23 - Twilio Webhook Replay Bypass via Randomized Event ID Normalization6.9 Medium
- hackerbay oneuptimeOneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay8.2 High
- micca auto electronics co., ltd. car alarm system ke700Micca KE700 Acceptance of previously used rolling codes8.4 High
- No product listedWeak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to...9.8 Critical
- powerdns recursorCrafted zones can lead to increased incoming network traffic5.3 Medium
- dji air, mavic mini, mini se +1 more +3 moreDJI Mavic Mini/Air/Spark/Mini SE Enhanced Wi-Fi Pairing authentication replay2.3 Low
- atomberg erica smart fan firmwareAn issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to...7.4 High
- lakefslakeFS is Missing Timestamp Validation in S3 Gateway Authentication6.5 Medium
- d3dsecurity xz-g12 firmwareD3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm...6.5 Medium
- d3dsecurity zx-g12 firmwareD3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz...9.8 Critical
- convoypanel panelPterodactyl TOTPs can be reused during validity window6.5 Medium
- siemens gridscale x prepayA vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected...5.3 Medium
- wazuhWazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities7.7 High
- microsoft azure bastion developerAzure Bastion Elevation of Privilege Vulnerability10.0 Critical
- jenkins saml, jenkins project saml plugin +1 moreJenkins SAML Plugin does not implement a replay cache7.5 High
- powerdns recursorCrafted delegations or IP fragments can poison cached delegations in Recursor8.2 High
- siemens simatic s7-1200 cpu v1 family (incl. siplus variants), simatic s7-1200 cpu v2 family (incl. siplus variants) +1 moreA vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. SIPLUS variants) (All...8.3 High
- newforma project centerNewforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx8.2 High
- newforma project centerNewforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx8.2 High
- newforma project centerNewforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashx6.0 Medium
- cognex in-sight explorer, in-sight 2000 series, in-sight 7000 series +2 more +4 moreCognex In-Sight Explorer and In-Sight Camera Firmware Authentication Bypass by Capture-replay8.6 High
- positron px360bt firmwareThe Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure...6.8 Medium
- zhenfeng13 my-blogzhenfeng13 My-Blog Frontend Blog Article Comment comment authentication replay6.9 Medium
- opentext advanced authenticationMalicious browser plugins may cause Authentication replay attack vulnerability to bypass authentication in OpenText Advanced Authentication6.1 Medium
- dradisframework dradisDradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of...4.1 Medium
- dell openmanage network integrationDell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by...8.8 High
- 201206030 novel-plusxxyopen/201206030 novel-plus CATCHA LoginController.java ajaxLogin authentication replay6.3 Medium
taylorednpmTaylored webhook validation vulnerabilitiesNo score- Show moreLoading…