cve.bz

CWE-294: Authentication Bypass by Capture-replay

Filter

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

What the weakness is: CWE-294 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 10
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-701 Browser in the Middle (BiTM) Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-294, as MITRE names them. Credits.

Ask an AI about CWE-294

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-294: Authentication Bypass by Capture-replay and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/294.html and https://cve.bz/cve/cwe/294?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-102894

    GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, an…

  2. 9.1CVE-2026-122220

    WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SA…

  3. 9.1CVE-2026-121640

    An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative act…

  4. 6.0CVE-2026-104381EPSS 0.1%

    A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sen…

  5. 7.5CVE-2026-41020EPSS 0.2%

    Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.

  6. 6.5CVE-2026-117470EPSS 0.4%

    Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAuthn assertion coul…

  7. 8.3CVE-2026-116825EPSS 0.2%

    YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/in…

  8. 7.6CVE-2026-89209EPSS 0.3%

    A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of…

  9. 8.7CVE-2026-116201EPSS 0.3%

    Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/ac…

  10. 7.4CVE-2026-65824EPSS 0.3%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential a…

  11. 4.2CVE-2026-114617EPSS 0.3%

    Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when…

  12. 3.1CVE-2026-87952EPSS 0.2%

    Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  13. 7.4CVE-2026-103314EPSS 0.4%

    A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unex…

  14. 6.4CVE-2026-104105EPSS 0.3%

    FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and…

  15. 4.2CVE-2026-55167EPSS 0.2%

    LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP sessi…

  16. 7.5CVE-2026-89070EPSS 0.4%

    Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

  17. 8.8CVE-2026-12655EPSS 0.3%

    A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated attacker can change the device's webserver password without valid credentials. This could result in admin account takeover or unauthorized modification of devic…

  18. 9.1CVE-2026-92120EPSS 0.3%

    OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

  19. 6.8CVE-2026-9226EPSS 0.2%

    Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.

  20. 6.8CVE-2026-105485EPSS 0.4%

    Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.

  21. 8.1CVE-2026-73636EPSS 0.4%

    Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted …

  22. 9.3CVE-2026-103655EPSS 0.4%

    MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the user login flow whe…

  23. 7.7CVE-2026-82379EPSS 0.4%

    Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonc…

  24. 8.2CVE-2026-100834EPSS 0.3%

    http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter of ServerFilters.DigestAuth and DigestAuthProvider to { true }, so every nonce i…

  25. 8.6CVE-2026-77967EPSS 0.2%

    The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a va…

  26. 7.5CVE-2026-75907EPSS 0.5%

    The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended…

  27. 8.2CVE-2026-87119EPSS 0.6%

    Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, …

  28. 7.6CVE-2026-94112EPSS 0.4%

    mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode ag…

  29. 8.1CVE-2026-54148EPSS 0.6%

    http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the ac…

  30. 7.0CVE-2026-45720EPSS 0.1%

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state opera…

  31. 7.4CVE-2026-90997EPSS 0.4%

    A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulner…

  32. 5.3CVE-2026-73443EPSS 0.3%

    On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement an…

  33. 5.9CVE-2026-69206EPSS 0.4%

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc v…

  34. 9.8CVE-2026-88278EPSS 0.5%

    GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.

  35. 8.7CVE-2026-55250EPSS 0.9%

    Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-perfor…

  36. 7.4CVE-2026-84003EPSS 0.6%

    Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.

  37. 8.8CVE-2026-69676EPSS 0.8%

    Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.

  38. 9.1CVE-2026-73312EPSS 0.5%

    XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can …

  39. 9.1CVE-2026-73311EPSS 0.5%

    XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or…

  40. 5.3CVE-2022-51016EPSS 0.2%

    PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid l…

  41. 9.8CVE-2026-86219EPSS 0.5%

    Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares th…

  42. 7.4CVE-2026-75034EPSS 0.3%

    A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In …

  43. 4.7CVE-2026-53636EPSS 0.3%

    Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider imple…

  44. 6.8CVE-2026-12704EPSS 0.3%

    When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who…

  45. 6.5CVE-2026-84306EPSS 0.4%

    Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code …

  46. 5.1CVE-2026-82470EPSS 0.4%

    Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to byp…

  47. 6.5CVE-2026-13734EPSS 0.3%

    Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code co…

  48. 5.3CVE-2026-82220EPSS 0.3%

    Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.

  49. 7.5CVE-2025-61480EPSS 0.2%

    An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers.

  50. 7.5CVE-2025-61479EPSS 0.4%

    An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepts replayed application-layer payloads injected into…