CWE-294: Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
A kind of CWE-1390 Weak Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- zenhive mpp, machine payments protocol +1 moreStatic memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay8.2 High
- phpmyfaqphpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge9.1 Critical
- apache tomcatApache Tomcat: Limited replay attack possible with DIGEST authentication9.8 Critical
- unitronix betterdeskBetterDesk has a replay behavior vulnerability when devices are deleted7.7 High
- http4khttp4k: `DigestAuthProvider.verify` did not bind to request URI8.1 High
- laravel socialiteLaravel Socialite Facebook Provider Authentication Bypass via Nonce Replay9.2 Critical
- ibm iIBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager8.1 High
- ether etherpadEtherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token6.8 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in Navigator for i6.8 Medium
- nimiq core-rs-albatrossNimiq: Validity store off by one error7.5 High
- circl vulnerability-lookupReusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup8.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability8.0 High
- craftcms cmsCraft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey7.1 High
- apache cxfApache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay9.8 Critical
- red hat build of keycloak, jboss enterprise application platform expansion pack, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow6.4 Medium
- malach-it borutaBoruta accepts expired JWT client assertions due to missing exp claim validation9.1 Critical
- logtoIdP-initiated SAML sessions not reliably invalidated (replay)7.5 High
- craigjbass clearancekitClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots6.9 Medium
- sipeed picoclawSipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay6.9 Medium
- hcl dfxanalyticsHCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.5.5 Medium
- hcl dfxanalyticsHCL DFXAnalytics is affected by a Login Replay Attack vulnerability2.6 Low
- hcl software dfxserver, hcltech dfx server +1 moreHCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.8.2 High
- misskey-dev misskeyMisskey: TOTP tokens can be reused7.4 High
- logto-io logtoLogto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)6.4 Medium
- apache software foundation iotdbApache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials9.8 Critical
- No product listedMERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in...9.1 Critical
- better-auth, better-auth better auth, better-auth\/oauth-provider +2 moreBetter Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption7.6 High
- @better-auth oauth-provider, better-auth, better-auth better auth +1 more +3 moreBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking8.1 High
- gitea open source git serverGitea OAuth2 authorization codes lack expiry and reuse enforcement9.1 Critical
- gitea open source git serverGitea TOTP single-use enforcement defect allows OTP replay7.1 High
- suse rancherSAML Authentication Replay in Rancher9.5 Critical
github.com/juev/nebula-meshGonebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction2.7 Low- alps electric co., ltd. remote keyless entry system (rkes) r53r0Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack6.9 Medium
- apache software foundation shiroApache Shiro: Remember-me cookie isn't checked for expiry on the server2.0 Low
- rocket.chatRocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replay7.4 High
- curlenv-set cross-proxy Digest auth state leak9.1 Critical
- curlcross-origin Digest auth state leak9.8 Critical
- ibm db2, db2 on cloud pak for data and db2 warehouse on cloud pak for data, db2 warehouse +2 moreMultiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.5.3 Medium
- http4khttp4k before 6.48.0.0 Digest Authentication Replay Protection Bypass8.2 High
- corewcfCoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages7.4 High
- corewcfCoreWCF: SAML token replay protection is inoperative5.9 Medium
- apache apisixApache APISIX: Session replay issue in hmac-auth6.3 Medium
- wertheim gmbh safecontroller 5400 hardware for vault rooms (safe deposit locker system - microcontroller)Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay8.6 High
- broadcom spring web services, spring web services +1 moreWSS4J validation does not use configured replay cache3.7 Low
- siderolabs omniOmni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token7.0 High
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange4.1 Medium
- casdoorCVE-2026-90958.1 High
- microsoft ufoMicrosoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection5.9 Medium
- besen bs20 ev charging stationBesen BS20 EV Charging Station BLE/WiFi authentication replay2.3 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay6.8 Medium
- Show moreLoading…