Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.
A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic.
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
Psono Server CE & EE versions 3.1.0 through 7.2.3 contain an authentication bypass vulnerability due to improper handling of WebAuthn challenges. An attacker with the user's password and a captured valid WebAuthn assertion can replay the assertion multiple times to bypass the second factor authentication. This vulnerability was fixed in version 7.2.4.
CVE-2026-89209 is an authentication bypass vulnerability in Siemens Mendix SAML modules compatible with Mendix 9, 10, and 11. The affected versions do not adequately protect against replay attacks on SAML assertions in IdP-initiated authentication flows. This flaw allows unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML response. The vulnerability has a medium severity with a CVSS score of 6.8. Fixed versions are available.
OpenReception's appointment booking software prior to version 2.2.1 contains an authentication bypass vulnerability due to capture-replay of pending invite tokens. An attacker who captures such a token can replay it to register their own passkey on the invited account, gaining control of that account. If the invite is for a staff or tenant-admin role, this leads to access to the tenant context associated with that account. The issue is fixed in version 2.2.1.
Authlib versions prior to 1.9.0 contain an authentication bypass vulnerability in the OpenIDMixin.parse_id_token() method. This flaw allows an attacker who captures a valid signed ID token to replay it into an attacker-controlled session by exploiting how the nonce_supported claim is handled. The issue affects implicit and hybrid OpenID Connect flows or applications accepting externally supplied ID tokens. The vulnerability does not affect the plain authorization code flow and requires the token to pass signature, issuer, and audience validation. The flaw is fixed in Authlib version 1.9.0.
CVE-2026-87952 is an authentication bypass vulnerability in the Drupal SAML SSO - Service Provider module affecting versions from 0.0.0 up to but not including 3.2.0. The flaw allows remote attackers with stolen credentials to bypass authentication via a capture-replay attack. The vulnerability has a low CVSS score of 3.1, indicating limited impact. A fix is available in version 3.2.0.
A vulnerability in Red Hat Advanced Cluster Security for Kubernetes (RHACS) 4.10 allows authentication bypass via replay of valid SAML responses. The Central SAML authentication ACS endpoint does not track used SAML assertion or response identifiers, enabling an attacker with a valid signed SAML response to reuse it multiple times and obtain multiple authentication tokens. This issue affects deployments with SAML authentication enabled and an accessible ACS endpoint. Mitigations include restricting network access to the ACS endpoint and reducing SAML assertion lifetimes until a fixed version is applied.
FileRise versions prior to 3.23.0 have an improper authentication vulnerability involving TOTP replay. The system validates a TOTP code within the accepted time window but does not prevent reuse of the same code for the same account during that window. An attacker with valid primary credentials and a captured TOTP code can replay the code in another login session before it expires. This vulnerability allows bypassing the intended one-time use of TOTP codes but does not disclose credentials or TOTP secrets. The issue is fixed in version 3.23.0.
LDAP Account Manager (LAM) versions prior to 9.6 contain an authentication bypass vulnerability related to WebAuthn two-factor authentication. The challenge state remains in the PHP session after authentication, allowing a user who has already passed password authentication to reuse the signed WebAuthn ceremony state. This flaw requires a valid password, the same PHP session, and a valid authenticator signature, limiting practical risk. The issue is resolved in version 9.6.
CVE-2026-89070 is an authentication bypass vulnerability in the OpenID Connect (OIDC) module of Progress MOVEit Transfer. It allows an attacker to bypass authentication by replaying captured authentication data. The vulnerability affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The issue has a high severity rating with a CVSS score of 7.5. No known exploits in the wild have been reported. No explicit patch links are provided in the data.
CVE-2026-12655 is a high-severity authentication bypass vulnerability in Rockwell Automation 1732E ArmorBlock® I/O devices. An unauthenticated attacker can change the device's webserver password without valid credentials, potentially leading to admin account takeover or unauthorized configuration changes. The affected versions are from 0 up to and including 3.012. There is no information about an available patch or vendor advisory confirming remediation. No known exploits are reported in the wild.
CVE-2026-92120 is a critical authentication bypass vulnerability in Apache Allura affecting versions up to 1.21.0. It involves an OAuth1 request replay attack that allows unauthorized access. The issue is fixed in version 1.22.0, which users are strongly advised to upgrade to.
CVE-2026-105485 is an authentication bypass vulnerability in Devolutions Server versions 2026.3.7.0 and earlier. It affects the OAuth device authorization flow, allowing a remote attacker to take over a user's account by replaying a captured device verification link. The vulnerability requires user interaction (UI:R) and has a medium severity with a CVSS score of 6.8.
CVE-2026-9226 is an authentication bypass vulnerability in Devolutions Server affecting versions before 2026.3.8.0. It involves the Azure AD external login flow, where an attacker can replay a captured login-session token exposed in a redirect URL to take over a user's account. The vulnerability has a medium severity with a CVSS score of 6.8. A patch is available, and the product is a cloud service, so the vendor manages remediation.
CVE-2026-73636 is a high-severity authentication bypass vulnerability in the mod_auth_digest module of Apache HTTP Server 2.4.x. It allows an attacker to replay captured digest credentials to bypass authentication when the AuthDigestNonceLifetime is set to 0. This affects Apache HTTP Server versions from 2.4.0 up to but not including 2.4.69. Upgrading to version 2.4.69 mitigates the issue.