cve.bz

CWE-294: Authentication Bypass by Capture-replay, page 3

Filter

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

What the weakness is: CWE-294 at MITRE. OWASP Top 10: A07:2025 Authentication Failures

Related attack patterns (CAPEC): 10
  • CAPEC-60 Reusing Session IDs (aka Session Replay) Likelihood: High · Severity: High
  • CAPEC-94 Adversary in the Middle (AiTM) Likelihood: High · Severity: Very High
  • CAPEC-102 Session Sidejacking Likelihood: High · Severity: High
  • CAPEC-509 Kerberoasting Severity: High
  • CAPEC-555 Remote Services with Stolen Credentials Severity: Very High
  • CAPEC-561 Windows Admin Shares with Stolen Credentials
  • CAPEC-644 Use of Captured Hashes (Pass The Hash) Likelihood: Medium · Severity: High
  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) Likelihood: Low · Severity: High
  • CAPEC-652 Use of Known Kerberos Credentials Likelihood: Medium · Severity: High
  • CAPEC-701 Browser in the Middle (BiTM) Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-294, as MITRE names them. Credits.

Ask an AI about CWE-294

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-294: Authentication Bypass by Capture-replay and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/294.html and https://cve.bz/cve/cwe/294?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.3CVE-2026-35618EPSS 0.3%

    OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modifying query parameters. The verification path derives replay keys from the full …

  2. 7.5CVE-2026-30080EPSS 0.3%

    OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterfa…

  3. 7.5CVE-2026-34209EPSS 0.4%

    mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "<" instead of "<=" against the on-chain settled amount. An attacke…

  4. 9.3CVE-2026-32987EPSS 0.4%

    OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairi…

  5. 5.9CVE-2026-27855EPSS 0.3%

    Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to obser…

  6. 1.3CVE-2026-4583EPSS 0.3%

    A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth Handler. Performing a manipulation results in authentication bypass by capture-re…

  7. 6.9CVE-2026-32053EPSS 0.4%

    OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio web…

  8. 6.3CVE-2026-28449EPSS 0.3%

    OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook r…

  9. 7.1CVE-2026-20999EPSS 0.3%

    Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions.

  10. 7.2CVE-2025-13777EPSS 0.2%

    Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.

  11. 9.0CVE-2026-28787EPSS 0.3%

    OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client…

  12. 8.4CVE-2026-2540EPSS 0.2%

    The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previous…

  13. 9.8CVE-2025-67135EPSS 0.4%

    Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack.

  14. 5.3CVE-2026-24027EPSS 0.5%

    Crafted zones can lead to increased incoming network traffic.

  15. 8.2CVE-2025-59023EPSS 0.3%

    Crafted delegations or IP fragments can poison cached delegations in Recursor.

  16. 1.3CVE-2026-1743EPSS 0.4%

    A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the component Enhanced Wi-Fi Pairing. The manipulation leads to authentication bypass …

  17. 7.4CVE-2025-69822EPSS 0.4%

    An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafted deauth frame

  18. 4.8CVE-2025-68671EPSS 0.3%

    lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a val…

  19. 6.5CVE-2025-65553EPSS 0.2%

    D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and …

  20. 9.8CVE-2025-65552EPSS 0.4%

    D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement rolling codes, message authentication, or anti-replay protection, allowing an attack…

  21. 6.5CVE-2025-69197EPSS 0.4%

    Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward…

  22. 5.3CVE-2025-40807EPSS 0.3%

    A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication tokens. This could allow an authenticated but already locked-out user to establis…

  23. 9.1CVE-2025-30201EPSS 0.8%

    Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths i…

  24. 10.0CVE-2025-49752EPSS 0.9%

    Azure Bastion Elevation of Privilege Vulnerability

  25. 7.5CVE-2025-64131EPSS 0.5%

    Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a user's web browser and Jenkins to replay those requests, aut…

  26. 8.3CVE-2011-20002EPSS 0.3%

    A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family (incl. SIPLUS variants) (All versions < V2.0.2), SIMATIC S7-1200 CPU V2 family (incl. SIPLUS variants) (All versions < V2.0.2). Affected controllers are vulnerable to cap…

  27. 8.2CVE-2025-35061EPSS 0.4%

    Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the…

  28. 8.2CVE-2025-35058EPSS 0.4%

    Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the customer-…

  29. 6.0CVE-2025-35057EPSS 0.3%

    Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX servi…

  30. 8.6CVE-2025-54810EPSS 0.2%

    Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform management operations such as modifying system properties. The user management functionality handles sensitive data such as…

  31. 6.8CVE-2025-56448EPSS 0.3%

    The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The alarm system does not properly rotate or invalidate used codes, allowing repeated reuse of captured…

  32. 5.5CVE-2025-9100EPSS 0.6%

    A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by c…

  33. 6.1CVE-2025-8616EPSS 0.3%

    A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Authentication. This issue affects Advanced Authentication on or before 6.5.0.

  34. 4.3CVE-2023-50786EPSS 0.3%

    Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other autho…

  35. 8.8CVE-2025-36593EPSS 0.3%

    Dell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS protocol. An attacker with local network access could potentially exploit this vulnerability to fo…

  36. 2.9CVE-2025-6533EPSS 0.6%

    A vulnerability, which was classified as critical, has been found in xxyopen/201206030 novel-plus up to 5.1.3. Affected by this issue is the function ajaxLogin of the file novel-admin/src/main/java/com/java2nb/system/controller/LoginContro…

  37. 9.4CVE-2025-6030EPSS 0.2%

    Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Solu…

  38. 9.4CVE-2025-6029EPSS 0.7%

    Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack. …

  39. 2.7CVE-2024-38823EPSS 0.3%

    Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.

  40. 4.8CVE-2025-48012EPSS 0.3%

    Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.

  41. 7.6CVE-2025-30072EPSS 0.6%

    Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities without triggering an alarm.

  42. 4.8CVE-2025-47706EPSS 0.3%

    Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5…

  43. 8.0CVE-2025-46815EPSS 0.5%

    The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the cli…

  44. 9.1CVE-2021-27289EPSS 0.9%

    A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1.0.3, Door Sensor = v1.0.7, Motion Sensor = v1.0.12), where the Zigbee anti-replay mechanism - based on the frame count…

  45. 7.6CVE-2024-12137EPSS 0.3%

    Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: before V.01.01.

  46. 7.1CVE-2025-1887EPSS 0.4%

    SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC p…

  47. 9.1CVE-2025-26201EPSS 0.6%

    Credential disclosure vulnerability via the /staff route in GreaterWMS <= 2.1.49 allows a remote unauthenticated attackers to bypass authentication and escalate privileges.

  48. 8.8CVE-2024-12839EPSS 0.7%

    The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authenticat…

  49. 5.4CVE-2024-52534EPSS 0.3%

    Dell ECS, version(s) prior to ECS 3.8.1.3, contain(s) an Authentication Bypass by Capture-replay vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Session theft.

  50. 4.9CVE-2024-49595EPSS 0.5%

    Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of serv…