EUVD-2026-64193

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...

CVE-2026-48106: Missing Authentication for Critical Function

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replication receiver at internal/cluster/replication/receiver.go validates only the wire-format envelope length, opcode of inbound messages. The MsgReplicateSync payload itself is...

node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

GHSA-MQ36-523M-X7VV node-opcua missing nonce verification in UserNameIdentityToken authentication

Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...

CVE-2026-53424

CVE-2026-53424 is an authentication bypass by capture-replay in dropbox/samly , a SAML service provider library for Elixir, affecting versions 0.3.0 and later . The root cause is that Samly.Helper.decode_idp_auth_resp/3 calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no...

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay...

Replay Attack

Overview org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Replay Attack through the DPoPProofJwtDecoderFactory. An attacker can gain unauthorized access and impersonate a victim...

CVE-2026-55088

In ep_etherpad-lite versions 2.6.0–3.0.0, the GET /tokenTransfer/{uuid} handler in tokenTransfer.ts has no expiration check, no single-use enforcement, and echoes the raw author token in the response body via res.send(tokenData). Any attacker who obtains a transfer UUID can repeatedly redeem it t...

CVE-2026-55088 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...

CVE-2026-55088 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/uuid. Although the record includes createdAt, the...

CVE-2026-73136

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...

CVE-2026-73829

Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...

CVE-2026-67581

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

EEF-CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Summary Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-2...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-67581

ZenHive mpp (Elixir HTTP 402 payment library) versions 0.3.0 through before 0.6.3 contain an authentication bypass by capture-replay in the EVM payment method. The function MPP.Methods.EVM.verify/2 matches a transfer solely on token, recipient, and amount without binding the proof to the specific...

CVE-2026-67581 On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-challenge replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount ERC-20 or to...

CVE-2026-73136

CVE-2026-73136 is an authentication bypass by capture-replay in ZenHive mpp (versions 0.6.1 before 0.6.4), affecting the MPP.Methods.Tempo payment verification component. When a static "memo" is configured in method_config, the function check_matched_memo_binding/3 returns a match unconditionally...

CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...