By weakness (CWE)

CWE-294: related vulnerabilities

CVEs classified under CWE-294. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

12 published vulnerabilities

• CVE-2026-9095HIGH 8.1

  Casdoor, an open-source identity and access management platform, contains a critical flaw in how it processes SAML single sign-on requests. When a user logs in via SAML, the application accepts and authenticates the SAML assertion without checking whether it has already been used. An attacker who intercepts or obtains a valid SAML assertion—even days or weeks after it was originally issued—can replay it to gain a logged-in session as that user. This bypasses password and multi-factor authentication requirements entirely. The risk is particularly severe if an attacker targets administrator accounts, as they could gain full control of the Casdoor instance.

• CVE-2026-44946HIGH 7.4

  Rancher's SAML authentication system has a replay vulnerability that allows attackers to reuse previously captured SAML assertions. SAML assertions are security tokens sent during login; normally, they should only work once. Because Rancher's Assertion Consumer Service (ACS) handler fails to enforce this one-time-use restriction, an attacker positioned on the network could intercept a valid SAML assertion and replay it multiple times to impersonate the original user. This is a man-in-the-middle risk that affects Rancher 2.14.0 through 2.14.2.

• CVE-2026-54783HIGH 7.4

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a signature verification flaw in its WS-Security handling. The vulnerability allows an attacker who intercepts a signed SOAP message to reuse that same signature to execute different service operations on behalf of the legitimate user who originally signed it. This breaks the cryptographic guarantee that a signature is bound to a specific operation, creating a replay and privilege escalation risk in any service using vulnerable CoreWCF versions.

• CVE-2026-55759HIGH 7.4

  Rocket.Chat's Apple Sign-In feature has a critical authentication bypass vulnerability. The application correctly verifies that an Apple identity token is cryptographically signed by Apple, but it fails to validate important claims within that token—such as the intended audience, expiration time, or nonce. This means an attacker who obtains a valid Apple identity token (whether from logs, network interception, or another application) can replay it indefinitely to log in as the victim user without any time limit. The vulnerability affects multiple versions of Rocket.Chat across several release branches and is resolved in patched versions released in mid-June 2026.

• CVE-2026-20779HIGH 7.1

  Gitea, a popular self-hosted Git service, contains a flaw in its two-factor authentication (2FA) system that allows attackers to reuse the same time-based one-time password (TOTP) code multiple times. Instead of invalidating a code after first use, the vulnerability permits a valid code to work across different authentication sessions and through multiple access methods. An attacker who obtains a valid TOTP code—through phishing, shoulder surfing, or other means—can leverage it repeatedly before it naturally expires, effectively bypassing the single-use guarantee that 2FA is designed to enforce. This affects Gitea versions 1.5.0 through 1.26.2.

• CVE-2026-47341MEDIUM 6.5

  Apache APISIX versions 3.11.0 through 3.16.0 contain an authentication bypass vulnerability in the hmac-auth plugin. Under certain configurations, an attacker can capture and replay authentication tokens indefinitely, circumventing the token expiry mechanism designed to limit credential lifetime. This allows an attacker to maintain unauthorized access to protected APIs without re-authenticating, as long as they possess a valid token.

• CVE-2026-49319MEDIUM 6.5

  A 433 MHz remote keyless entry system (RKES) made by ALPS ALPINE CO., LTD. (FCC ID CWTR53R0) is vulnerable to replay attacks. An attacker within radio range can record two consecutive transmissions from a legitimate key fob, then replay that same pair repeatedly to unlock or lock a vehicle. Security researchers confirmed this vulnerability on a 2024 Suzuki Swift, demonstrating that the rolling-code authentication mechanism can be defeated through systematic replay of captured signals.

• CVE-2026-46538MEDIUM 5.9

  Microsoft UFO is an open-source automation framework that lets multiple devices work together on tasks. In version 3.0.1-4-ge2626659, it has a flaw where one authenticated device can trick another device by sending a fake task completion message. When Device A receives a task from the coordinator, the system should only accept a completion message from Device A itself. Instead, the system accepts completion messages from any authenticated device as long as they use the same task ID. An attacker with legitimate access to the network can exploit this to inject false results into another device's task, potentially disrupting automated workflows.

• CVE-2026-54779MEDIUM 5.9

  CoreWCF, a .NET Core implementation of Windows Communication Foundation, contains a flaw in its SAML token replay protection mechanism. When replay detection is enabled, the system fails to reject tokens that have already been used, allowing an attacker who intercepts a valid token to replay it multiple times. This undermines the security guarantee that tokens should only be valid once, potentially allowing unauthorized access even after the original user's session should have expired.

• CVE-2023-33854MEDIUM 5.3

  IBM's Db2 database platform, when deployed on Cloud Pak for Data, contains a weakness that allows authenticated users to bypass client-side security checks and alter input data through man-in-the-middle (MITM) attacks. The vulnerability affects Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data across versions 4.8 through 5.3. While this requires an attacker to already have valid credentials and network positioning, successful exploitation could lead to unauthorized data modification without detection by client-side safeguards.

• CVE-2026-49322MEDIUM 4.3

  The 2025 Indian Motorcycle Scout Bobber + Tech model contains a flaw in its wireless control system that allows someone with access to the motorcycle's internal network to steal the owner's PIN unlock code by observing just a single authentication attempt. Instead of using proper cryptographic security, the system performs simple mathematical operations that can be reversed to recover the PIN, completely bypassing the bike's primary security lock.

• CVE-2026-41000LOW 3.7

  Spring Web Services has a flaw in how it manages replay protection for SOAP messages. When security administrators configure protection against replay attacks—where an attacker re-uses old, valid authentication tokens or timestamps—the system doesn't always enforce those protections correctly. An attacker could potentially replay old username tokens, timestamps, or certain SAML assertions to bypass authentication, even though the operator believed replay protection was active. This is a configuration gap: the replay cache exists but isn't consistently connected to the validation logic that needs it.