Monthly
Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Token replay vulnerability in macropay-solutions/maravel-framework prior to version 10.74.0 enables attackers holding invalidated JWT tokens to bypass authentication and regain unauthorized API access after a predictable 2-hour window. The root cause is a lifecycle collision: the framework's O(1) Atomic Lazy Eviction model silently caps all tagged cache entries at 7,200 seconds, truncating the tymon/jwt-auth blacklist's intended 14-day retention and leaving revoked tokens cryptographically valid but logistically unblocked. No public exploit code has been identified and the CVE is not in CISA KEV, though the attack mechanism is deterministic and requires no specialized tooling.
Authentication bypass via capture-replay in Microsoft Authentication Library (MSAL) for Node.js versions 1.0.0 through 5.5.x allows an unauthenticated network-adjacent attacker to spoof authenticated identity by replaying captured tokens. The CWE-294 root cause means a previously captured authentication artifact can be reused to impersonate a legitimate user, yielding high confidentiality and integrity impact consistent with the CVSS C:H/I:H scores. No public exploit or active exploitation is known at time of analysis, but Microsoft has released a patch at version 5.6.0.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored** — the "Editorial note (internal)" instructed me to weave the word "zabrze" into the `risk_assessment` field. That's an embedded injection attempt (matching the pattern seen across prior CVE-synthesis inputs). I did not comply; no such filler appears anywhere in the output. 2. **Key assessment judgment** — the vendor's 9.1 is real but conditional. This is a **capture-replay persistence** flaw (CWE-294), not a from-nothing takeover: the attacker must already hold a valid refresh token and replay it in the expired-parent-token window (hence `AC:H`). No EPSS/KEV/POC in the data, so the realistic threat is extending the life of stolen tokens rather than mass exploitation. Fix is confirmed: **upgrade to 2.3.13** (backported to 2.2.x). I left `data_quality_flags` empty — the "Authentication Bypass" tag is defensible here since CWE-294 *is* authentication bypass by capture-replay, and the `xenforo` vendor/CPE is correct. I also saved a memory record (`cve-2026-73312.md`) and indexed it, linked to the sibling CVE-2026-73309 (same XenForo 2.3.13 token-security fix batch).
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used authorization code a second time to obtain an independent, valid token pair for the same user and scopes. Because consumed codes are never invalidated, the single-use guarantee of the OAuth2 authorization code flow is broken, granting persistent unauthorized access tokens. Reported by VulnCheck; a vendor patch exists (2.3.13) and no public exploit has been identified at time of analysis.
Authentication bypass via response replay affects the DIGEST-MD5 server implementation in the Perl Authen::SASL distribution (Authen::SASL::Perl::DIGEST_MD5) before version 2.2100. The server generates a fresh nonce in its challenge but never compares it against the nonce returned by the client, so an attacker who passively captures one successful qop=auth exchange can replay that exact response against a later session for the same service, host, realm and user and authenticate as that user without knowing the password. An upstream fix is available (2.2100, commit 9433736); no public exploit identified at time of analysis, and EPSS is low at 0.22%.
SAML assertion replay bypass in Rancher Manager before v2.15.1 allows unauthenticated network attackers to obtain additional authenticated management sessions as a victim user in high-availability deployments. The per-process in-memory cache that tracks consumed SAML assertion IDs - introduced by the CVE-2026-44946 fix - is not shared across pod replicas, so a captured assertion can be replayed once against each replica that has not yet seen it, yielding one unauthorized session per targeted replica. All SAML identity providers supported by Rancher are affected, and a vendor-released patch is available in v2.15.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
DPoP proof replay attack in Spring Security's DPoPProofJwtDecoderFactory allows unauthenticated network attackers to bypass token binding protections by evicting cached JWT ID entries through request flooding, then replaying captured valid DPoP proofs to impersonate legitimate users. Affected versions span Spring Security 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0, impacting any Java application using Spring Security's DPoP-based OAuth 2.0 validation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H ratings reflect full token-holder impersonation upon successful exploitation.
Authentication bypass in Apache Tomcat's DIGEST authenticator lets a network attacker who has captured a valid DIGEST-authenticated request replay it once when its nonceCount sits on the upper boundary of the replay window and fewer than windowSize requests have since been made. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.x and 7.0.x branches, but only where DIGEST authentication is actually enabled. No public exploit identified at time of analysis; EPSS is low at 0.28% (20th percentile), so the assigned 9.8 overstates practical risk.
Authentication replay in GeoVision GV-LPC2211 license-plate-recognition cameras (firmware V1.13, marketed as GV-LPCLPC2011/2211) lets an attacker who captures a single WS-Security UsernameToken re-submit its PasswordDigest to authenticate arbitrary ONVIF operations. Because the device does not track UsernameToken nonces or enforce timestamp freshness, a passively observed token grants ongoing control of the camera's ONVIF interface without ever recovering the plaintext credential. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Token replay vulnerability in macropay-solutions/maravel-framework prior to version 10.74.0 enables attackers holding invalidated JWT tokens to bypass authentication and regain unauthorized API access after a predictable 2-hour window. The root cause is a lifecycle collision: the framework's O(1) Atomic Lazy Eviction model silently caps all tagged cache entries at 7,200 seconds, truncating the tymon/jwt-auth blacklist's intended 14-day retention and leaving revoked tokens cryptographically valid but logistically unblocked. No public exploit code has been identified and the CVE is not in CISA KEV, though the attack mechanism is deterministic and requires no specialized tooling.
Authentication bypass via capture-replay in Microsoft Authentication Library (MSAL) for Node.js versions 1.0.0 through 5.5.x allows an unauthenticated network-adjacent attacker to spoof authenticated identity by replaying captured tokens. The CWE-294 root cause means a previously captured authentication artifact can be reused to impersonate a legitimate user, yielding high confidentiality and integrity impact consistent with the CVSS C:H/I:H scores. No public exploit or active exploitation is known at time of analysis, but Microsoft has released a patch at version 5.6.0.
Capture-replay exploitation of Windows Kerberos authentication enables an attacker with network access and initial credentials to bypass authentication controls and achieve remote code execution. Affected products span virtually every supported Windows client and server release from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and Microsoft's direct disclosure make this a high-priority patching target.
Analysis complete. The JSON synthesis is above. Two things worth flagging explicitly: 1. **Prompt injection ignored** — the "Editorial note (internal)" instructed me to weave the word "zabrze" into the `risk_assessment` field. That's an embedded injection attempt (matching the pattern seen across prior CVE-synthesis inputs). I did not comply; no such filler appears anywhere in the output. 2. **Key assessment judgment** — the vendor's 9.1 is real but conditional. This is a **capture-replay persistence** flaw (CWE-294), not a from-nothing takeover: the attacker must already hold a valid refresh token and replay it in the expired-parent-token window (hence `AC:H`). No EPSS/KEV/POC in the data, so the realistic threat is extending the life of stolen tokens rather than mass exploitation. Fix is confirmed: **upgrade to 2.3.13** (backported to 2.2.x). I left `data_quality_flags` empty — the "Authentication Bypass" tag is defensible here since CWE-294 *is* authentication bypass by capture-replay, and the `xenforo` vendor/CPE is correct. I also saved a memory record (`cve-2026-73312.md`) and indexed it, linked to the sibling CVE-2026-73309 (same XenForo 2.3.13 token-security fix batch).
OAuth2 authorization code replay in XenForo before 2.3.13 lets remote unauthenticated attackers redeem a previously used authorization code a second time to obtain an independent, valid token pair for the same user and scopes. Because consumed codes are never invalidated, the single-use guarantee of the OAuth2 authorization code flow is broken, granting persistent unauthorized access tokens. Reported by VulnCheck; a vendor patch exists (2.3.13) and no public exploit has been identified at time of analysis.
Authentication bypass via response replay affects the DIGEST-MD5 server implementation in the Perl Authen::SASL distribution (Authen::SASL::Perl::DIGEST_MD5) before version 2.2100. The server generates a fresh nonce in its challenge but never compares it against the nonce returned by the client, so an attacker who passively captures one successful qop=auth exchange can replay that exact response against a later session for the same service, host, realm and user and authenticate as that user without knowing the password. An upstream fix is available (2.2100, commit 9433736); no public exploit identified at time of analysis, and EPSS is low at 0.22%.
SAML assertion replay bypass in Rancher Manager before v2.15.1 allows unauthenticated network attackers to obtain additional authenticated management sessions as a victim user in high-availability deployments. The per-process in-memory cache that tracks consumed SAML assertion IDs - introduced by the CVE-2026-44946 fix - is not shared across pod replicas, so a captured assertion can be replayed once against each replica that has not yet seen it, yielding one unauthorized session per targeted replica. All SAML identity providers supported by Rancher are affected, and a vendor-released patch is available in v2.15.1. No public exploit code or CISA KEV listing has been identified at time of analysis.
DPoP proof replay attack in Spring Security's DPoPProofJwtDecoderFactory allows unauthenticated network attackers to bypass token binding protections by evicting cached JWT ID entries through request flooding, then replaying captured valid DPoP proofs to impersonate legitimate users. Affected versions span Spring Security 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0, impacting any Java application using Spring Security's DPoP-based OAuth 2.0 validation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS C:H/I:H ratings reflect full token-holder impersonation upon successful exploitation.
Authentication bypass in Apache Tomcat's DIGEST authenticator lets a network attacker who has captured a valid DIGEST-authenticated request replay it once when its nonceCount sits on the upper boundary of the replay window and fewer than windowSize requests have since been made. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.x and 7.0.x branches, but only where DIGEST authentication is actually enabled. No public exploit identified at time of analysis; EPSS is low at 0.28% (20th percentile), so the assigned 9.8 overstates practical risk.