Authentication Bypass by Capture-replay
CWE-294
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
We track 125 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
- Architecture and Design: Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
Latest Authentication Bypass by Capture-replay vulnerabilities
- 8.2 High severity
MicroSCADA SYS600: Authentication Bypass by Capture-replay
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enab
- 8.4 High severity
caterease: Authentication Bypass by Capture-replay
An issue in Horizon Business Services Inc. Caterease Software 16.0.1.1663 through 24.0.1.2405 and possibly later versions allows a local attacker to perform an Authentication Bypass by Capture-replay attack due to insufficient protection against capture-replay
- 8.7 High severity
Vigilant Fixed LPR Coms Box (BCAV1F2-C600): Authentication Bypass by Capture-replay
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.
- 8.1 High severity
strapi: Authentication Bypass by Capture-replay
Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker
- 7.8 High severity
2.4! Display 55, SD/U12.55.11-825: Authentication Bypass by Capture-replay
Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
- 8.1 High severity
authkit-nextjs: Authentication Bypass by Capture-replay
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
- 9.8 Critical severity
visual__planning_8: Authentication Bypass by Capture-replay
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token.
- 7.5 High severity
MELSEC WS Series WS0-GETH00200: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the aff
- 8.8 High severity
msh30q: Authentication Bypass by Capture-replay
The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions (e.g., thermostat's temperature
- 8.1 High severity
Ultraloq Ul3 Bt Firmware: Authentication Bypass by Capture-replay
Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range.
- 8.8 High severity
CLUSTERPRO X (EXPRESSCLUSTER X): Authentication Bypass by Capture-replay
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
- 8.1 High severity
Mendix Applications using Mendix 10: Authentication Bypass by Capture-replay
A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.37), Mendix Applications using Mendix 8 (All versions < V8.18.27), Mendix Applications using Mendix 9
- 7.5 High severity
Saml2: Authentication Bypass by Alternate Name
Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. Thi
- 7.5 High severity
VMware Tools: Authentication Bypass by Capture-replay
A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target
- 8.1 High severity
mojobox: Authentication Bypass by Capture-replay
ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy (BLE) is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them
- 7.5 High severity
HarmonyOS: Authentication Bypass by Capture-replay
Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect service confidentiality.
- 9.1 Critical severity
MELSEC-F Series FX3U-16MR/ES: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially cra
- 9.1 Critical severity
PowerSYSTEM Center: Authentication Bypass by Capture-replay
SUBNET PowerSYSTEM Center versions 2020 U10 and prior are vulnerable to replay attacks which may result in a denial-of-service condition or a loss of data integrity.
- 7.5 High severity
Dg-hamb Firmware: Authentication Bypass by Capture-replay
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack.
- 7.5 High severity
Bw-is22 Firmware: Authentication Bypass by Capture-replay
Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.
- 9.8 Critical severity
Microsoft Office Outlook Privilege Escalation Exploited
Microsoft Outlook Elevation of Privilege Vulnerability
- 9.8 Critical severity
EcoStruxure Control Expert: Authentication Bypass by Capture-replay
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions),
- 9.8 Critical severity
NetWeaver ABAP Server and ABAP Platform: Authentication Bypass by Capture-replay
SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates informati
- 7.8 High severity
OpenHarmony: Authentication Bypass by Capture-replay
platform_callback_stub in misc subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege.
- 7.8 High severity
OpenHarmony: Authentication Bypass by Capture-replay
softbus_client_stub in communication subsystem within OpenHarmony-v3.0.5 and prior versions has an authentication bypass vulnerability which allows an "SA relay attack".Local attackers can bypass authentication and attack other SAs with high privilege.
- 8.1 High severity
Zoe E-tech Firmware: Authentication Bypass by Capture-replay
The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.
- 7.5 High severity
Bluetooth Core Specification: Authentication Bypass by Capture-replay
Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when at least one device supports BR/EDR Secure Connections pairing and the other BR/ED
- 7.5 High severity
Bluetooth Core Specification: Authentication Bypass by Capture-replay
Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via adjacent access when the MITM negotiates Legacy Passkey Pairing with the pairing Initiator an
- 9.8 Critical severity
Mendix SAML (Mendix 7 compatible): Authentication Bypass by Capture-replay
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatibl
- 8.1 High severity
iota All-In-One Security Kit: Authentication Bypass by Capture-replay
An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-m
- 8.1 High severity
Ax10 Firmware: Authentication Bypass by Capture-replay
TP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user.
- 8.1 High severity
Octopus Server: Authentication Bypass by Capture-replay
In affected versions of Octopus Server it is possible to use the Git Connectivity test function on the VCS project to initiate an SMB request resulting in the potential for an NTLM relay attack.
- 7.5 High severity
Django-mfa2: Authentication Bypass by Capture-replay
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
- 7.5 High severity
WN531G3: Authentication Bypass by Capture-replay
Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient net
- 9.8 Critical severity
Mendix SAML (Mendix 7 compatible): Authentication Bypass by Capture-replay
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible
- 9.8 Critical severity
kubevela: Authentication Bypass by Capture-replay
KubeVela is an application delivery platform Users using KubeVela's VelaUX APIServer could be affected by an authentication bypass vulnerability. In KubeVela prior to versions 1.4.11 and 1.5.4, VelaUX APIServer uses the `PlatformID` as the signed key to genera
- 7.5 High severity
lti-1-3-php-library: Authentication Bypass by Capture-replay
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request. Users should upgrade to version 5.0
- 7.5 High severity
Machine automation controller NJ series…: Authentication Bypass by Capture-replay
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models
- 8.1 High severity
Machine automation controller NJ series…: Authentication Bypass by Capture-replay
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1
- 8.8 High severity
Xiaomi Lamp 1 Firmware: Authentication Bypass by Capture-replay
Xiaomi Lamp 1 v2.0.4_0066 was discovered to be vulnerable to replay attacks. This allows attackers to to bypass the expected access restrictions and gain control of the switch and other functions via a crafted POST request.