Credential replay occurs when an attacker intercepts credentials—such as an API access token—and reuses them to impersonate the credential owner. section 4.4
Figure 4.3 An authentication system manages users’ identities, credentials, and access permissions. When a user logs in, they get back an API access token with specific permissions.
An access token represents a logged-in user and carries specific permissions, making a stolen token useful for impersonation. section 4.4
A stolen token becomes another user’s session
A threat actor obtains an access token from intercepted traffic or exposed logs, then submits it to the API as though they were the user. The danger is especially serious for banking, finance, and healthcare applications. Weak validation can increase the impact: accepting an unsigned token, accepting an expired token, or failing to validate a JWT signature can enable account hijacking or privilege escalation. section 4.4
Prevent replay by adding proof of token ownership, rather than trusting possession of the credential alone. Review token handling and validation wherever credentials can enter, travel through, or remain in API systems. section 4.4
