Common Weakness Enumeration

CWE-294 Authentication Bypass by Capture-replay

Description

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Associated Reviewed Advisories

Vulnerabilities classified under CWE-294 ordered by modification date.

25 reviewed records

Advisory ID	NVD ID	Severity	PURLs	Summary	Last Modified
GHSA-p28p-j94q-pg32	CVE-2026-54148	HIGH	maven/org.http4k/http4k-security-digest	http4k: `DigestAuthProvider.verify` did not bind to request URI	2026-09-24
GHSA-9xww-74xv-gjfp	CVE-2026-69206	MODERATE	maven/org.http4s/http4s-ember-core_2.12 maven/org.http4s/http4s-ember-core_2.13 maven/org.http4s/http4s-ember-core_3	Http4s: DigestAuth allows replay of captured requests	2026-09-15
GHSA-9xv2-5v5q-p794	CVE-2026-65905	CRITICAL	maven/org.apache.tomcat.embed/tomcat-embed-core maven/org.apache.tomcat/tomcat maven/org.apache.tomcat/tomcat-catalina	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability	2026-09-02
GHSA-r3j6-gpjw-qfjr	CVE-2026-84306	MODERATE	-	Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used	2026-09-01
GHSA-5v69-g2m3-3hq3	CVE-2026-26232	CRITICAL	golang/code.gitea.io/gitea	Gitea OAuth2 authorization codes can be reused after expiry	2026-09-01
GHSA-8qq9-r6cc-qjv9	CVE-2026-41000	LOW	maven/org.springframework.ws/spring-ws-security	Spring Web Services: WSS4J validation does not use configured replay cache	2026-08-21
GHSA-vqfp-p66c-xrp9	CVE-2026-55088	MODERATE	npm/ep_etherpad-lite	ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token	2026-08-13
GHSA-3763-qp59-59vf	CVE-2026-46369	HIGH	-	nimiq-blockchain: Validity store off by one error	2026-08-12
GHSA-wg23-69c2-gjc8	-	CRITICAL	-	Craft CMS: Passkey login accepts replayed WebAuthn assertions	2026-08-07
GHSA-gx3v-q759-g323	CVE-2026-20779	HIGH	golang/code.gitea.io/gitea	Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface	2026-07-21
GHSA-7w99-5wm4-3g79	CVE-2026-53518	HIGH	npm/@better-auth/oauth-provider npm/better-auth	@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive	2026-07-20
GHSA-392p-2q2v-4372	CVE-2026-53517	HIGH	npm/@better-auth/oauth-provider npm/better-auth	Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption	2026-07-20
GHSA-v2jf-442r-6mjh	-	LOW	golang/github.com/juev/nebula-mesh	nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction	2026-06-26
GHSA-c7jm-38gq-h67h	-	MODERATE	maven/org.http4k/http4k-security-digest	http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments	2026-06-19
GHSA-gqv6-pwcg-87r8	CVE-2026-54783	HIGH	nuget/CoreWCF.Primitives	CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages	2026-06-19
GHSA-9jr3-rj99-8jq3	CVE-2026-54779	MODERATE	nuget/CoreWCF.Primitives	CoreWCF: SAML token replay protection is inoperative	2026-06-19
GHSA-vw39-2wj9-4q86	CVE-2022-42731	HIGH	pypi/django-mfa2	django-mfa2 vulnerable to MFA Replay attack	2026-06-10
GHSA-rc6v-5rmx-w5mv	-	MODERATE	golang/github.com/arnika-project/arnika	arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS	2026-06-09
GHSA-5x9f-6vg5-qg4m	CVE-2026-45720	HIGH	golang/github.com/siderolabs/omni	Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token	2026-06-05
GHSA-w4p5-rfh6-cwrv	CVE-2026-37982	MODERATE	maven/org.keycloak/keycloak-services	Keycloak: Unauthorized account takeover via WebAuthn token replay	2026-06-04
GHSA-pjv4-3c63-699f	CVE-2026-42602	HIGH	golang/github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension	opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay	2026-05-14
GHSA-xh72-v6v9-mwhc	CVE-2026-44109	CRITICAL	npm/openclaw	OpenClaw: Feishu webhook and card-action validation now fail closed	2026-05-12
GHSA-q8w6-w55c-ccv5	CVE-2026-6420	MODERATE	pypi/keylime	Keylime has a hardcoded attestation challenge nonce that allows replay attacks	2026-05-11
GHSA-37v6-fxx8-xjmx	CVE-2026-41351	MODERATE	npm/openclaw	OpenClaw: Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding	2026-05-06
GHSA-89r3-6x4j-v7wf	CVE-2026-41337	MODERATE	npm/openclaw	OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection	2026-05-06