Authentication Bypass

Apache Tomcat is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of the upper boundary of the DIGEST authentication replay window, which allows an attacker to replay a previously captured authenticated request once while its nonceCount remains within the replay...

Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

CVE-2026-65905

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

DEBIAN-CVE-2026-65905

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while...

CVE-2026-58085

The wg(4) driver in FreeBSD contains a flaw where it fails to verify the success of the MAC verification step after dispatching a decrypt operation to the OpenCrypto framework (OCF) . This allows the driver to silently accept packets with an invalid Poly1305 authentication tag. A remote attacker ...

FreeBSD -- Missing MAC validation in wg(4) packet decryption

Problem Description: After dispatching a decrypt operation to OCF and receiving the result, the wg4 driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. Impact: A remote attacker who can send UDP...

Pterodactyl TOTPs can be reused during validity window

Summary When a user signs into an account with 2FA enabled they are prompted to enter a token. When that token is used, it is not sufficiently marked as used in the system allowing an attacker that intercepts that token to then use it in addition to a known username/password during the token...

FreeBSD -- Missing IPsec anti-replay window check

Problem Description: A missing check means that an attacker can reinject an old packet and it will be accepted and processed by the IPsec endpoint. Impact: The impact depends on the higher-level protocols in use over IPsec. For example, an attacker who can capture and inject packets could cause a...

Debian Security Advisory DSA 1175-1 (isakmpd)

The remote host is missing an update to isakmpd announced via advisory DSA 1175-1. A flaw has been found in isakmpd, OpenBSD's implementation of the Internet Key Exchange protocol, that caused Security Associations to be created with a replay window of 0 when isakmpd was acting as the responder...

DSA-1175-1 isakmpd

Bulletin has no description...

CVE-2006-4436

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations SA with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection...

CVE-2006-4436

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations SA with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection...

CVE-2006-4436: Undefined Security Weakness

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations SA with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection...

CVE-2006-4436

isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, creates Security Associations SA with a replay window of size 0 when isakmpd acts as a responder during SA negotiation, which allows remote attackers to replay IPSec packets and bypass the replay protection...

CVE-2006-4436

CVE-2006-4436 affects OpenBSD’s isakmpd (SAK/ISAKMP daemon) in OpenBSD 3.8, 3.9 and possibly earlier. The flaw causes Security Associations to be created with a replay window of 0 when isakmpd acts as the responder during SA negotiation, enabling remote attackers to replay IPsec packets and bypas...