OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replay

Summary The WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during verification. This violates the WebAuthn specification W3C Web Authentication Level 2, §13.4.3...

PT-2026-22998

Name of the Vulnerable Software and Affected Versions OneUptime versions 10.0.11 and prior Description The WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from the client request body during...

CVE-2025-68113

ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the HMAC computation. An attacker can bypass intended challenge expiration and reuse previously solved challenges by submitting a valid proof-of-work with a modified expiration value,...

EUVD-2020-25302

Malware in sbrugna...

RHEL 2.1 : vnc (RHSA-2002:287)

Updated VNC packages are available to fix a challenge replay attack that is present in the VNC server. VNC is a tool for providing a remote graphical user interface. The VNC DES authentication scheme is implemented using a challenge-response architecture, producing a random and different challeng...

Moderate: Red Hat Security Advisory: vnc security update

Updated VNC packages are available to fix a challenge replay attack that is present in the VNC server. VNC is a tool for providing a remote graphical user interface. The VNC DES authentication scheme is implemented using a challenge-response architecture, producing a random and different challeng...