533 matches found
CVE-2026-77967 Botslab G980H Dashcams Authentication Bypass by Capture-replay
The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another clie...
CVE-2026-77967
The Botslab G980H dash camera firmware is vulnerable to an authentication bypass due to a lack of freshness verification or client association checks for authentication values. An unauthenticated attacker with adjacent network access can capture a valid authentication value and perform a capture-...
CVE-2026-87119
Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer repeatedly. The payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits and scopes only, with nothing tying it to th...
CVE-2026-87119
CVE-2026-87119 is an authentication bypass by capture-replay in ZenHive mpp (Elixir), affecting versions 0.14.0 through 0.16.1 . The root cause lies in MPP.Methods.Tempo.KeyAuthorization.verify/3: the payer signs a Tempo KeyAuthorization over the chain id, key type, key id, expiry, limits, and sc...
CVE-2022-29593
CVE-2022-29593 - 캡처 재생을 통한 인증 우회 Dingtian-DT-R002 Title 캡처 재생을 통한 인증 우회 게시됨: 버전: 1.0 공급업체: Shenzhen Dingtian Technologies Co.,Ltd 제품: 2채널 릴레이 보드/릴레이 카드 영향받는 버전: 펌웨어 V3.1.276A 제품 - Dingtian DTR004 Ali Express 링크 제품 설명 2채널 릴레이 보드/릴레이 카드 WiFi/RS485/이더넷 지원 기술 사양 root@kitploit: Overview Support multip...
CVE-2022-43704
CVE-2022-43704 - 非エンドポイントからのチャネルアクセス可能/キャプチャリプレイによる認証バイパス Sinilink XY-WFTX WiFiリモートサーモスタットモジュール 温度コントローラ タイトル 製品ドキュメント アプリケーション ユーザーマニュアル ハードウェア データシート ESP8285 バックコンバータ ファームウェア 製品説明 root@kitploit: Overview WIFI Remote Thermostat High Precision Temperature Controller Module Cooling and Heating APP...
CVE-2026-94112: Authentication Bypass by Capture-replay
mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...
CVE-2026-54148: Authentication Bypass by Capture-replay
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the actual request URL. An attacker who captures a valid Digest...
CVE-2026-45720: Authentication Bypass by Capture-replay
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured...
CVE-2026-90997: Authentication Bypass by Capture-replay
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...
CVE-2026-73443: Authentication Bypass by Capture-replay
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...
CVE-2026-69206: Authentication Bypass by Capture-replay
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...
Astra Linux – Vulnerability in Tomcat9
Authentication Bypass due to a capture-replay vulnerability in Apache Tomcat’s DIGEST authenticator. If a client makes a DIGEST authenticated request with a nonceCount value exceeding the upper boundary of the replay window before windowSize requests have been made, that request can be replayed...
BIT-TOMCAT-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication
Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...
CVE-2026-88278: Authentication Bypass by Capture-replay
GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection, allowing a captured PasswordDigest token to be replayed for subsequent ONVIF operations...
CVE-2026-84003
Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-69676
Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network...
EUVD-2026-73922
Authentication bypass by capture-replay in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-84003
Microsoft Authentication Library (MSAL) for Node.js is affected by an authentication bypass via capture-replay that allows an unauthorized network attacker to perform spoofing . The underlying cause is the ability to capture and replay authentication tokens, leading to high confidentiality and in...