Monthly
TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authenticator app code still within the configured clock-skew window, even after the legitimate account holder has authenticated with a newer code from the same window. The flaw is a cache-key design error: used-code state was keyed on md5(secret + code) rather than md5(secret) alone, making each distinct valid code within the window independently reusable once rather than collectively consuming the accepted timestep as RFC 6238 requires. An attacker holding the target's password and one intercepted TOTP code has approximately four minutes to authenticate and fully bypass MFA. No public exploit has been identified at time of analysis; email-based MFA is explicitly unaffected.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
DPoP proof replay attack in Spring Security's DPoPProofJwtDecoderFactory allows unauthenticated network attackers to bypass token binding protections by evicting cached JWT ID entries through request flooding, then replaying captured valid DPoP proofs to impersonate legitimate users. Affected versions span Spring Security 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0, impacting any Java application using Spring Security's DPoP-based OAuth 2.0 validation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H ratings reflect full token-holder impersonation upon successful exploitation.
Authentication bypass in Apache Tomcat's DIGEST authenticator lets a network attacker who has captured a valid DIGEST-authenticated request replay it once when its nonceCount sits on the upper boundary of the replay window and fewer than windowSize requests have since been made. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.x and 7.0.x branches, but only where DIGEST authentication is actually enabled. No public exploit identified at time of analysis; EPSS is low at 0.28% (20th percentile), so the assigned 9.8 overstates practical risk.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Replay of settled EVM blockchain transaction hashes against ZenHive mpp versions 0.3.0-0.6.2 allows unauthenticated remote attackers to obtain paid resources at no cost. MPP.Methods.EVM.verify/2 validates payment by matching a submitted transaction hash against on-chain token/recipient/amount fields but neither binds the proof to a specific challenge nor records prior use; because MPP.Plug regenerates challenge.id on every 402 response, any historical on-chain transfer visible on a public block explorer can satisfy an unlimited number of subsequent payment challenges on a static-price route. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the attack prerequisites are trivially met given the public nature of blockchain transaction data.
TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authenticator app code still within the configured clock-skew window, even after the legitimate account holder has authenticated with a newer code from the same window. The flaw is a cache-key design error: used-code state was keyed on md5(secret + code) rather than md5(secret) alone, making each distinct valid code within the window independently reusable once rather than collectively consuming the accepted timestep as RFC 6238 requires. An attacker holding the target's password and one intercepted TOTP code has approximately four minutes to authenticate and fully bypass MFA. No public exploit has been identified at time of analysis; email-based MFA is explicitly unaffected.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
Zephyr RTOS's WireGuard VPN receive handler in wg_process_data_message() commits permanent peer-state mutations - endpoint roaming update, liveness timer refresh, and keypair promotion - before validating the anti-replay counter, allowing an on-path attacker who captures a single valid encrypted datagram to replay it from a spoofed source address and hijack the tunnel endpoint. Because AEAD decryption succeeds for any authentic ciphertext regardless of freshness, the spoofed replay is processed as legitimate and irreversibly alters peer state before the replay check fires and returns -EINVAL. No public exploit has been identified at time of analysis; patch is available via upstream commit 260c32ef.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
DPoP proof replay attack in Spring Security's DPoPProofJwtDecoderFactory allows unauthenticated network attackers to bypass token binding protections by evicting cached JWT ID entries through request flooding, then replaying captured valid DPoP proofs to impersonate legitimate users. Affected versions span Spring Security 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0, impacting any Java application using Spring Security's DPoP-based OAuth 2.0 validation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H ratings reflect full token-holder impersonation upon successful exploitation.
Authentication bypass in Apache Tomcat's DIGEST authenticator lets a network attacker who has captured a valid DIGEST-authenticated request replay it once when its nonceCount sits on the upper boundary of the replay window and fewer than windowSize requests have since been made. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.x and 7.0.x branches, but only where DIGEST authentication is actually enabled. No public exploit identified at time of analysis; EPSS is low at 0.28% (20th percentile), so the assigned 9.8 overstates practical risk.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Replay of settled EVM blockchain transaction hashes against ZenHive mpp versions 0.3.0-0.6.2 allows unauthenticated remote attackers to obtain paid resources at no cost. MPP.Methods.EVM.verify/2 validates payment by matching a submitted transaction hash against on-chain token/recipient/amount fields but neither binds the proof to a specific challenge nor records prior use; because MPP.Plug regenerates challenge.id on every 402 response, any historical on-chain transfer visible on a public block explorer can satisfy an unlimited number of subsequent payment challenges on a static-price route. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, though the attack prerequisites are trivially met given the public nature of blockchain transaction data.