What is Authentication Bypass by Capture-replay (CWE-294)?

TL;DR: Authentication Bypass by Capture-replay (CWE-294) is an authentication vulnerability where malicious users can bypass authentication by replaying network traffic, compromising confidentiality.

What is Authentication Bypass by Capture-replay?

Authentication Bypass by Capture-replay (CWE-294) is a type of authentication vulnerability that occurs when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question, with minor changes. As defined by the MITRE Corporation under CWE-294, and classified by the OWASP Foundation under A07:2025 - Authentication Failures, this vulnerability compromises confidentiality.

Quick Summary

Authentication Bypass by Capture-replay is a critical vulnerability that allows malicious users to bypass authentication by replaying network traffic. This can compromise sensitive data and lead to serious consequences for businesses. It is essential to implement secure authentication mechanisms and detect this vulnerability in applications.

Jump to: Quick Summary · Authentication Bypass by Capture-replay Overview · How Authentication Bypass by Capture-replay Works · Business Impact of Authentication Bypass by Capture-replay · Authentication Bypass by Capture-replay Attack Scenario · How to Detect Authentication Bypass by Capture-replay · How to Fix Authentication Bypass by Capture-replay · Framework-Specific Fixes for Authentication Bypass by Capture-replay · How to Ask AI to Check Your Code for Authentication Bypass by Capture-replay · Authentication Bypass by Capture-replay Best Practices Checklist · Authentication Bypass by Capture-replay FAQ · Vulnerabilities Related to Authentication Bypass by Capture-replay · References · Scan Your Own Site

Authentication Bypass by Capture-replay Overview

What: Authentication Bypass by Capture-replay is a type of authentication vulnerability that occurs when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question, with minor changes.

Why it matters: Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication, compromising confidentiality.

Where it occurs: This vulnerability can occur in any application that uses HTTP/2, HTTP/3, WebSockets, or SSL/TLS.

Who is affected: Any user who can sniff network traffic and replay it to the server in question may be able to bypass authentication.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Authentication Bypass by Capture-replay Works

Root Cause

The root cause of this vulnerability is the design of the product making it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question, with minor changes.

Attack Flow

1. The attacker sniffs network traffic.
2. The attacker replays the traffic to the server in question.
3. The server authenticates the request without proper verification.

Prerequisites to Exploit

• The attacker must be able to sniff network traffic.
• The attacker must be able to replay the traffic to the server in question.

Vulnerable Code

GET /path/to/resource HTTP/1.1
Host: example.com
Authorization: Bearer <access_token>

This code is vulnerable because it does not verify the authenticity of the request.

Secure Code

GET /path/to/resource HTTP/1.1
Host: example.com
Authorization: Bearer <access_token>
Content-Type: application/json

{
  "timestamp": 1643723900,
  "checksum": "1234567890abcdef"
}

This code is secure because it includes a timestamp and checksum to ensure that the request is authentic.

Business Impact of Authentication Bypass by Capture-replay

Confidentiality: Sensitive data may be accessed without proper authentication, compromising confidentiality.

• Financial: Businesses may incur significant financial losses due to unauthorized access.
• Compliance: Businesses may face regulatory fines for failing to protect sensitive data.
• Reputation: Businesses may suffer reputational damage due to security breaches.

Authentication Bypass by Capture-replay Attack Scenario

1. The attacker sniffs network traffic.
2. The attacker replays the traffic to the server in question.
3. The server authenticates the request without proper verification.
4. The attacker gains access to sensitive data.

How to Detect Authentication Bypass by Capture-replay

Manual Testing

• Check for sequence numbers and message replay.
• Verify that authentication mechanisms are secure.

Automated Scanners (SAST / DAST)

• Static analysis can detect vulnerabilities in code, but may not catch dynamic behavior.
• Dynamic testing is required to detect this vulnerability.

PenScan Detection

PenScan’s scanner engines actively test for this issue and provide detailed reports on findings.

False Positive Guidance

• Be cautious of false positives caused by similar sequence numbers or message replay patterns.
• Verify that the vulnerability is present in the code before reporting it as a finding.

How to Fix Authentication Bypass by Capture-replay

• Implement a secure authentication mechanism that includes sequence or time stamping functionality along with a checksum to ensure messages can be parsed only once.
• Sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

Framework-Specific Fixes for Authentication Bypass by Capture-replay

Java

import java.security.MessageDigest;
import java.util.Base64;

public class SecureAuthentication {
  public static String authenticate(String request) throws Exception {
    // Generate a timestamp and checksum
    long timestamp = System.currentTimeMillis();
    String checksum = MessageDigest.getInstance("SHA-256").digest(request.getBytes()).toString();

    // Sign the message with cryptography
    String signature = Base64.getEncoder().encodeToString(MessageDigest.getInstance("RSA").digest(checksum));

    return request + "&timestamp=" + timestamp + "&checksum=" + checksum + "&signature=" + signature;
  }
}

Node.js

const crypto = require('crypto');

function authenticate(request) {
  // Generate a timestamp and checksum
  const timestamp = Date.now();
  const checksum = crypto.createHash('sha256').update(request).digest('hex');

  // Sign the message with cryptography
  const signature = crypto.createSign('RSA-SHA256').update(checksum).sign(null, null, 'base64');

  return request + "&timestamp=" + timestamp + "&checksum=" + checksum + "&signature=" + signature;
}

Python/Django

import hashlib
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.backends import default_backend

def authenticate(request):
  # Generate a timestamp and checksum
  timestamp = int(time.time())
  checksum = hashlib.sha256(request.encode()).hexdigest()

  # Sign the message with cryptography
  private_key = serialization.load_pem_private_key(
    request['private_key'].encode(),
    password=None,
    backend=default_backend()
  )
  signature = private_key.sign(
    checksum.encode(),
    rsa.PSS(
      mgf=rsa.MGF1(hashes.SHA256()),
      salt_length=rsa.PSS.MAX_LENGTH
    ),
    hashes.SHA256()
  )

  return request + "&timestamp=" + str(timestamp) + "&checksum=" + checksum + "&signature=" + signature.hex()

PHP

<?php

function authenticate($request) {
  // Generate a timestamp and checksum
  $timestamp = time();
  $checksum = hash('sha256', $request);

  // Sign the message with cryptography
  $privateKey = openssl_pkey_get_private('file://path/to/private/key');
  $signature = openssl_sign($checksum, $signature, $privateKey, 'RSA-SHA256');

  return $request . "&timestamp=" . strval($timestamp) . "&checksum=" . $checksum . "&signature=" . bin2hex($signature);
}

How to Ask AI to Check Your Code for Authentication Bypass by Capture-replay

Review the following [language] code block for potential CWE-294 Authentication Bypass by Capture-replay vulnerabilities and rewrite it using primary fix technique: [paste code here]

Authentication Bypass by Capture-replay Best Practices Checklist

✅ Implement a secure authentication mechanism that includes sequence or time stamping functionality along with a checksum to ensure messages can be parsed only once. ✅ Sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content. ✅ Verify the authenticity of requests using a secure method, such as HMAC. ✅ Use a secure protocol for communication, such as HTTPS.

Authentication Bypass by Capture-replay FAQ

How does Authentication Bypass by Capture-replay occur?

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question, with minor changes.

What are the consequences of Authentication Bypass by Capture-replay?

Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.

How can I prevent Authentication Bypass by Capture-replay?

Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once, and sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.

What is the business impact of Authentication Bypass by Capture-replay?

Confidentiality is compromised as sensitive data is accessed without proper authentication.

How can I detect Authentication Bypass by Capture-replay in my application?

PenScan’s scanner engines actively test for this issue, and manual testing involves checking for sequence numbers and message replay.

How do I fix Authentication Bypass by Capture-replay in my application?

Implement a secure authentication mechanism that includes sequence or time stamping functionality along with a checksum to ensure messages can be parsed only once.

What are some best practices to prevent Authentication Bypass by Capture-replay?

Utilize secure authentication mechanisms, implement message replay detection, and use cryptography to sign messages.

Vulnerabilities Related to Authentication Bypass by Capture-replay

References

• MITRE CWE-294
• OWASP A07:2025 - Authentication Failures
• CAPEC-102, CAPEC-509, CAPEC-555, CAPEC-561, CAPEC-60, CAPEC-644, CAPEC-645, CAPEC-652, CAPEC-701, CAPEC-94
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Authentication Bypass by Capture-replay and other risks before an attacker does.