CWE-294

High likelihood

Authentication Bypass by Capture-replay

Parent: CWE-1390 - Weak Authentication

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

241 vulnerabilities with CWE-294
CVE-2025-65553 MEDIUM
D3D Wi-Fi Home Security System ZX-G12 v2.1.17 - DoS
CVSS 6.5
CVE-2025-65552 CRITICAL
D3D Wi-Fi Home Security System ZX-G12 v2.1.1 - Info Disclosure
CVSS 9.8
CVE-2025-69197 MEDIUM
Pterodactyl <1.11.11 - Info Disclosure
CVSS 6.5
CVE-2025-40807 MEDIUM
Gridscale X Prepay <V4.2.1 - Auth Bypass
CVSS 6.3
CVE-2025-30201 HIGH
Wazuh <4.13.0 - Privilege Escalation
CVSS 7.7
CVE-2025-49752 CRITICAL
Azure Bastion - Privilege Escalation
CVSS 10.0
CVE-2025-64131 HIGH
Jenkins SAML Plugin <4.583 - Auth Bypass
CVSS 7.5
CVE-2025-35061 MEDIUM
Newforma Project Center < 2023.2 - Unauthenticated NTLM Hash Capture via LegacyIntegrationServices.asmx
CVSS 5.9
CVE-2025-35058 MEDIUM
Newforma Project Center < 2023.2 - Unauthenticated NTLMv2 Hash Capture via MarkupServices.ashx
CVSS 5.9
CVE-2025-35057 MEDIUM
Newforma Project Center < 2024.3 - Unauthenticated NTLM Hash Capture via SMB Connection Replay
CVSS 5.3
CVE-2025-54810 HIGH
Cognex In-Sight Explorer & Camera Firmware - Info Disclosure
CVSS 8.0
CVE-2025-56448 MEDIUM
Positron PX360BT SW REV 8 - Replay Attack
CVSS 6.8
CVE-2025-9100 MEDIUM
zhenfeng13 My-Blog 1.0.0 - Auth Bypass
CVSS 5.3
CVE-2025-8616 MEDIUM
OpenText Advanced Authentication <6.5.0 - Auth Bypass
CVE-2025-36593 HIGH
Dell OpenManage Network Integration < 3.8 - Authentication Bypass via RADIUS Capture-replay
CVSS 8.8
CVE-2025-6533 MEDIUM
xxyopen/201206030 novel-plus <5.1.3 - Auth Bypass
CVSS 5.6
CVE-2025-6030 CRITICAL
Cyclone Matrix TRF Smart - Replay Attack
CVE-2025-6029 CRITICAL
KIA-branded Aftermarket Generic Smart - Replay Attack
CVE-2025-48012 MEDIUM
Drupal One Time Password < 8.x-1.3 - Authentication Bypass via Capture-replay
CVSS 4.8
CVE-2025-30072 HIGH
Tiiwee X1 Alarm System TWX1HAKV2 - Auth Bypass
CVSS 7.6
CVE-2025-47706 MEDIUM
miniorange_2fa 5.0.0-5.2.0 - Authentication Bypass via Capture-replay
CVSS 4.8
CVE-2025-46815 HIGH
ZITADEL < 2.70.10 and 2.71.x < 2.71.9 and 3.0.0-rc.1-3.0.0 - Session Hijacking via IdP Intent Reuse
CVSS 8.0
CVE-2025-1887 HIGH
Sage 200 Spain <2025.35.000 - Privilege Escalation
CVE-2025-26201 CRITICAL
GreaterWMS <= 2.1.49 - Info Disclosure
CVSS 9.1
CVE-2024-38823 LOW
Salt's Request Server - Replay Attack
CVSS 2.7
Details
Vulnerabilities 241
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits