Reusing a Nonce, Key Pair in Encryption
CWE-323
Nonces should be used for the present occasion and only once.
We track 19 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
How this weakness is prevented
- Implementation: Use techniques such as requiring incrementing, time based and/or challenge response to assure uniqueness of nonces.
Latest Reusing a Nonce, Key Pair in Encryption vulnerabilities
- 8.4 High severity
Krill: Reusing a Nonce, Key Pair in Encryption
The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.
- 8.2 High severity
BC-LTS-JAVA: Reusing a Nonce, Key Pair in Encryption
In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes
- 7.4 High severity
wolfEngine: Reusing a Nonce, Key Pair in Encryption
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce p
- 7.4 High severity
wolfProvider: Reusing a Nonce, Key Pair in Encryption
wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce
- 7.4 High severity
ePA3-Service-OpenSource: Reusing a Nonce, Key Pair in Encryption
ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU mess
- 7.1 High severity
Snapdragon: Reusing a Nonce, Key Pair in Encryption
Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.
- 9.1 Critical severity
cas: Reusing a Nonce, Key Pair in Encryption
Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect mu
- 7.7 High severity
We found a chain of combining multiple weaknesses in the product that could allow an attacker…
We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa, pretix-bit
- 7.5 High severity
wolfSSL: Reusing a Nonce, Key Pair in Encryption
AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery.
- 9.1 Critical severity
Crypt::DSA: Reusing a Nonce, Key Pair in Encryption
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, a
- 9.1 Critical severity
Discuz! X5.0: Reusing a Nonce, Key Pair in Encryption
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key betwe
- 7.1 High severity
wolfSSL: Reusing a Nonce, Key Pair in Encryption
In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wc_AriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal count
- 8.1 High severity
Hue Bridge: Reusing a Nonce, Key Pair in Encryption
Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exp
- 7.3 High severity
Red Hat Enterprise Linux 10: Reusing a Nonce, Key Pair in Encryption
A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does not properly track issued nonces or enforce the required incrementing nonce-count (nc) attribute. This vulnerability allows a remote attack
- 7.5 High severity
strongMan: Reusing a Nonce, Key Pair in Encryption
strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database
- 9.8 Critical severity
MyXalytics: Reusing a Nonce, Key Pair in Encryption
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
- 9.1 Critical severity
hpke-js: Reusing a Nonce, Key Pair in Encryption
hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This ca
- 9.1 Critical severity
netty-incubator-codec-ohttp: Integer Overflow or Wraparound
netty-incubator-codec-ohttp is the OHTTP implementation for netty. BoringSSLAEADContext keeps track of how many OHTTP responses have been sent and uses this sequence number to calculate the appropriate nonce to use with the encryption algorithm. Unfortunately,
- 8.1 High severity
TETRA Standard: Authorization Bypass Through User-Controlled Key
Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active