CVE-2026-82379 | High | 7.7 | 2026-09-28 | Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain… |
CVE-2026-100834 | Medium | 5.9 | 2026-09-27 | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier parameter… |
CVE-2026-77967 | High | 8.1 | 2026-09-24 | The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting cl… |
CVE-2026-75907 | High | 7.5 | 2026-09-24 | The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is… |
CVE-2026-87119 | | | 2026-09-22 | Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly… |
CVE-2026-94112 | Medium | 6.8 | 2026-09-20 | mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Att… |
CVE-2026-54148 | High | 8.1 | 2026-09-18 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest doe… |
CVE-2026-45720 | High | 7.0 | 2026-09-17 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interce… |
CVE-2026-90997 | High | 7.4 | 2026-09-17 | A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak… |
CVE-2026-73443 | Medium | 4.7 | 2026-09-16 | On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on wh… |
CVE-2026-69206 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonc… |
CVE-2026-88278 | Critical | 9.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be repla… |
CVE-2026-55250 | | | 2026-09-08 | Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structur… |
CVE-2026-84003 | High | 7.4 | 2026-09-08 | Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a netwo… |
CVE-2026-69676 | High | 8.8 | 2026-09-08 | Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network. |
CVE-2026-73312 | High | 7.4 | 2026-09-08 | XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to… |
CVE-2026-73311 | High | 7.4 | 2026-09-08 | XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previo… |
CVE-2022-51016 | Medium | 6.1 | 2026-09-07 | PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the… |
CVE-2026-86219 | Critical | 9.8 | 2026-09-06 | Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.
server_start gene… |
CVE-2026-75034 | High | 7.4 | 2026-09-03 | A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-pro… |
CVE-2026-53636 | Medium | 4.7 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a security vulnerability has been identified in… |
CVE-2026-12704 | Medium | 6.8 | 2026-09-02 | When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP… |
CVE-2026-84306 | Medium | 6.5 | 2026-09-01 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/… |
CVE-2026-82470 | Medium | 5.4 | 2026-08-29 | Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Atta… |
CVE-2026-13734 | Medium | 6.5 | 2026-08-28 | Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late… |
CVE-2026-82220 | Medium | 5.3 | 2026-08-28 | Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions. |
CVE-2025-61480 | High | 7.5 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofe… |
CVE-2025-61479 | High | 7.5 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SP… |
CVE-2026-46369 | High | 7.5 | 2026-08-26 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict… |
CVE-2026-41707 | High | 7.4 | 2026-08-25 | Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based repl… |
CVE-2026-65905 | Critical | 9.8 | 2026-08-25 | Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a… |
CVE-2026-53424 | | | 2026-08-20 | Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubm… |
CVE-2026-55088 | Medium | 6.8 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an a… |
CVE-2026-73136 | High | 7.5 | 2026-08-19 | Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unr… |
CVE-2026-67581 | High | 7.5 | 2026-08-19 | Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain tr… |
CVE-2026-76214 | High | 7.4 | 2026-08-19 | phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key obj… |
CVE-2026-50575 | High | 7.7 | 2026-08-18 | BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthentica… |
CVE-2026-73683 | High | 8.1 | 2026-08-14 | Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens b… |
CVE-2026-17045 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper se… |
CVE-2026-17268 | Medium | 6.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token. |
CVE-2026-73431 | | | 2026-08-12 | Vulnerability-Lookup contains an
authentication weakness in its account activation and password-recovery
mechanism. Activation and recovery links were genera… |
CVE-2026-62911 | High | 8.0 | 2026-08-11 | Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-72780 | Medium | 6.5 | 2026-08-11 | Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay ca… |
CVE-2026-68079 | Critical | 9.8 | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementati… |
CVE-2026-18967 | Medium | 6.4 | 2026-08-06 | A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated… |
CVE-2026-53431 | | | 2026-07-30 | Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authen… |
CVE-2026-15614 | High | 7.5 | 2026-07-23 | Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window. |
CVE-2026-47133 | | | 2026-07-20 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite… |
CVE-2026-16083 | Medium | 5.3 | 2026-07-18 | A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the… |
CVE-2026-56453 | Medium | 5.5 | 2026-07-16 | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the serv… |
CVE-2026-35141 | Low | 2.6 | 2026-07-16 | HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit v… |
CVE-2026-35149 | High | 8.2 | 2026-07-16 | HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploi… |
CVE-2026-57574 | | | 2026-07-10 | Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vulnerability in Time-based One-Time Password (TOTP) authenti… |
CVE-2026-55370 | Medium | 6.4 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification accepted a successfully used TOT… |
CVE-2026-28564 | Critical | 9.8 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB.
REST Basic Authentication Accepts Stale Cached Credenti… |
CVE-2026-51597 | Critical | 9.1 | 2026-07-09 | MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can c… |
CVE-2026-54783 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and suppo… |
CVE-2026-54779 | Medium | 5.9 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is… |
CVE-2026-26232 | Critical | 9.1 | 2026-07-03 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange. |
CVE-2026-20779 | High | 7.1 | 2026-07-03 | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-fa… |
CVE-2026-8927 | Critical | 9.1 | 2026-07-03 | When reusing a libcurl handle for sequential transfers driven by
environment-variable proxy configuration, libcurl fails to clear the proxy
authentication stat… |
CVE-2026-11856 | Critical | 9.8 | 2026-07-03 | Successfully using libcurl to do a transfer to a specific HTTP origin
(`hostA`) with **Digest** authentication and then changing the origin to a
different one… |
CVE-2026-44946 | High | 7.4 | 2026-06-30 | A SAML authentication replay vulnerability in Rancher's Assertion
Consumer Service (ACS) handler did not enforce
one-time use of SAML assertion, potentially… |
CVE-2026-49319 | Medium | 6.5 | 2026-06-25 | Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attac… |
CVE-2026-56130 | | | 2026-06-25 | "Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after t… |
CVE-2026-55759 | High | 7.4 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat'… |
CVE-2023-33854 | Medium | 5.3 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-s… |
CVE-2026-47341 | Medium | 6.5 | 2026-06-19 | Authentication Bypass by Capture-replay vulnerability in Apache APISIX.
Attacker can benefit from certain configurations in hmac-auth to re-use a token foreve… |
CVE-2026-34021 | | | 2026-06-15 | The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller witho… |
CVE-2026-41000 | Low | 3.7 | 2026-06-11 | Wss4jSecurityInterceptor did not consistently wire Apache WSS4J ReplayCache instances into RequestData for validation-time checks. As a result, protections aga… |
CVE-2026-49322 | Medium | 4.3 | 2026-05-29 | Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with… |
CVE-2026-9095 | High | 8.1 | 2026-05-28 | Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go call… |
CVE-2026-46538 | Medium | 5.9 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's constellation client tracks… |
CVE-2026-9398 | Low | 3.1 | 2026-05-24 | A security vulnerability has been detected in Besen BS20 EV Charging Station up to 20260426. This affects an unknown part of the component BLE/WiFi. Such manip… |
CVE-2026-37982 | Medium | 6.8 | 2026-05-19 | A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuth… |
CVE-2026-42602 | High | 8.1 | 2026-05-13 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party wh… |
CVE-2026-7168 | Medium | 5.3 | 2026-05-13 | Successfully using libcurl to do a transfer over a specific HTTP proxy
(`proxyA`) with **Digest** authentication and then changing the proxy host to
a second o… |
CVE-2026-41351 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a replay detection bypass vulnerability in webhook signature handling that treats Base64 and Base64URL encoded signatures as… |
CVE-2026-35618 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.23 contains a replay identity vulnerability in Plivo V2 signature verification that allows attackers to bypass replay protection by modi… |
CVE-2026-30080 | High | 7.5 | 2026-04-08 | OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE send… |
CVE-2026-34209 | High | 7.5 | 2026-03-31 | mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher… |
CVE-2026-32987 | Critical | 9.8 | 2026-03-29 | OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify… |
CVE-2026-27855 | Medium | 6.8 | 2026-03-27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP cred… |
CVE-2026-4583 | Medium | 5.0 | 2026-03-23 | A vulnerability was detected in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. Affected by this issue is some unknown functionality of the component Bluetooth H… |
CVE-2026-32053 | Medium | 6.5 | 2026-03-21 | OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowin… |
CVE-2026-28449 | Medium | 6.5 | 2026-03-19 | OpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without… |
CVE-2026-20999 | High | 7.5 | 2026-03-16 | Authentication bypass by replay in Smart Switch prior to version 3.7.69.15 allows remote attackers to trigger privileged functions. |
CVE-2025-13777 | High | 8.3 | 2026-03-13 | Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1… |
CVE-2026-28787 | High | 8.2 | 2026-03-06 | OneUptime is a solution for monitoring and managing online services. In version 10.0.11 and prior, the WebAuthn authentication implementation does not store th… |
CVE-2026-2540 | | | 2026-02-15 | The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes… |
CVE-2025-67135 | Critical | 9.8 | 2026-02-11 | Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack. |
CVE-2026-24027 | Medium | 5.3 | 2026-02-09 | Crafted zones can lead to increased incoming network traffic. |
CVE-2025-59023 | High | 8.2 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2026-1743 | Low | 3.1 | 2026-02-02 | A vulnerability has been found in DJI Mavic Mini, Air, Spark and Mini SE up to 01.00.0500. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-69822 | High | 7.4 | 2026-01-22 | An issue in Atomberg Atomberg Erica Smart Fan Firmware Version: V1.0.36 allows an attacker to obtain sensitive information and escalate privileges via a crafte… |
CVE-2025-68671 | Medium | 6.5 | 2026-01-15 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated re… |
CVE-2025-65553 | Medium | 6.5 | 2026-01-12 | D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit contin… |
CVE-2025-65552 | Critical | 9.8 | 2026-01-12 | D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement roll… |
CVE-2025-69197 | Medium | 6.5 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Us… |
CVE-2025-40807 | Medium | 6.3 | 2025-12-09 | A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected application is vulnerable to capture-replay of authentication t… |