CVE-2026-73636 is an authentication bypass vulnerability in the mod_auth_digest module of Apache HTTP Server 2.4.x. It allows a man-in-the-middle attacker to replay captured digest authentication credentials by exploiting a flaw triggered when AuthDigestNonceLifetime is set to 0. This issue affects all platforms running Apache HTTP Server versions from 2.4.0 up to and including 2.4.68. The vulnerability is fixed in version 2.4.69.
CVE-2026-82379 is an authentication bypass vulnerability in Apache Roller 6.1.5 affecting installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storage. The flaw allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority due to lack of nonce uniqueness and timestamp freshness enforcement. Apache Roller 6.1.6 and later remove WSSE as an AtomPub authentication method, mitigating this issue.
CVE-2026-77967 is a vulnerability in the Botslab G980H dash camera firmware where the device accepts a reusable authentication value without properly verifying its freshness or client association. This flaw allows an unauthenticated attacker with adjacent network access to replay a captured valid authentication token from another client, thereby establishing an authenticated session and gaining access to privileged device functions.
The Norwegian Cruise Line door access control system uses only the static 7-byte UID from an NTAG212 NFC chip to grant entry. This UID is a manufacturer serial number transmitted in clear text and is not designed to authenticate the holder. The system's reliance on this UID alone constitutes identification rather than proper authentication, lacking challenge-response mechanisms to prevent cloning or unauthorized access.
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly.
The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to the challenge that prompted it. MPP.Methods.Tempo.KeyAuthorization.verify/3 in lib/mpp/methods/tempo/key_authorization.ex pins each of those signed fields against the subscription request, and the access key it pins is a static per-endpoint server key, so one signed authorization verifies against every challenge the server issues for the same subscription terms. MPP.Methods.Tempo.Subscription.activate/4 deduplicates activations by challenge id, so presenting the captured credential under a fresh challenge produces a different dedup key, claim_activation succeeds, and the subscription transaction is built and broadcast again. Each replay charges the payer's wallet a new first-period settlement and re-authorizes the server key, bounded only by the subscription expiry and the chain's own semantics for re-installing an existing key.
This issue affects mpp: from 0.14.0 before 0.16.2.
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.
CVE-2026-73443 is an authentication bypass vulnerability in Arista Networks EOS affecting VRRPv2 IP-AH authentication. An unauthenticated attacker on the same layer 2 network segment can capture and replay legitimate VRRP advertisements indefinitely. This replay can cause stale VRRP state to be advertised, preventing backup routers from taking over the virtual gateway after the master router fails, resulting in denial of service for hosts relying on the virtual gateway.
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations.
Maravel Framework versions prior to 10.74.0 have a high-severity token replay vulnerability due to a lifecycle mismatch between stateless token validation and relational caching layers. This flaw causes blacklisted JWT tokens to be prematurely evicted from cache, allowing them to be reused for up to 14 days. The issue arises from the tymon/jwt-auth package's use of cache tags with a forced 2-hour eviction ceiling, which truncates the intended 14-day blacklist lifespan. Cache flushes or natural evictions invalidate blacklist records, enabling token replay attacks. The vulnerability is architectural and not fixed by a simple framework upgrade; version 10.74.0 introduces a workaround to decouple token identifiers from tagged caches. Users must apply configuration changes to avoid early cache evictions and ensure token blacklists persist for their full lifespan.
CVE-2026-84003 is an authentication bypass vulnerability in Microsoft Authentication Library (MSAL) for Node.js. The flaw allows an attacker to perform capture-replay attacks over a network, enabling spoofing and unauthorized access. Versions from 1.0.0 up to but not including 5.6.0 are affected. The vulnerability has a high severity rating with a CVSS score of 7.4. An official fix is available in version 5.6.0.
CVE-2026-69676 is an authentication bypass vulnerability in Windows Kerberos affecting multiple versions of Microsoft Windows 10, including Version 1607. The flaw allows an authorized attacker to execute code remotely over a network by leveraging a capture-replay attack. This vulnerability has a high severity rating and has been officially fixed in several Windows 10 builds.
CVE-2026-86219 is a critical authentication bypass vulnerability in Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100. The flaw allows an attacker to replay a captured authentication response due to the server not verifying the nonce returned by the client against the originally issued nonce. This enables authentication as a legitimate user without knowing their password.
CVE-2026-75034 is an authentication bypass vulnerability in SUSE Rancher Manager prior to version 2.15.1. The flaw arises from insufficient replay protection of SAML assertions in high-availability deployments, allowing an attacker who captures a valid assertion to replay it against multiple replicas and gain unauthorized authenticated sessions.
Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in the Open edX LMS platform's LTI (Learning Tools Interoperability) Provider implementation. The validate_timestamp_and_nonce function in lms/djangoapps/lti_provider/signature_validator.py does not validate OAuth nonces or timestamps, allowing an attacker who captures a valid LTI launch request to replay it an unlimited number of times without detection. This issue has been patched via commit 3a5ac85.
When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.
CVE-2026-82220 is an authentication bypass vulnerability in WPMU DEV's Forminator plugin affecting versions up to 1.57.1. It is classified under CWE-294, indicating an authentication bypass issue. The vulnerability allows unauthenticated attackers to bypass authentication mechanisms via a capture-replay method. The CVSS v3.1 base score is 5.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-46369 is an off-by-one error in the Nimiq core-rs-albatross Rust implementation of the Albatross consensus algorithm. Versions prior to 1.5.1 have a flaw in the validity store's transaction expiration logic, allowing a remote attacker to replay the same signed transaction within a specific block window. This replay can cause sender and recipient balances to be updated twice. The issue is fixed in version 1.5.1.
CVE-2026-41707 is an authentication bypass vulnerability in Spring Security's DPoPProofJwtDecoderFactory. The issue arises from a cache-based replay attack where the internal cache for JWT ID claims has a strict size limit. Attackers can flood the cache with dummy requests to evict legitimate entries and then replay intercepted valid DPoP proofs to bypass authentication. This affects Spring Security versions 7.1.0, 7.0.0 through 7.0.6, and 6.5.0 through 6.5.11. The vulnerability has a high severity with a CVSS score of 7.4. No official patch or remediation guidance is currently provided.