Capture-replay is an attack technique in which an adversary records authentication material and sends it again to a target later. The reused data may be a token, cookie, nonce, signed request, or other proof that the server accepts as valid. If the system does not bind that material to a specific session, time window, client, or one-time use, the replayed request can look legitimate.
This matters because replay can turn a single intercepted login artifact into unauthorized access without breaking encryption or guessing a password. It appears in real attacks against web apps, VPNs, SSO flows, and server-side auth paths, including cases where a front-end accepts previously seen values. Defenses include mutual authentication, short-lived and one-time tokens, nonce tracking, channel binding, strict session validation, and replay detection in logs. In a suspected replay flaw, defenders should verify whether the same credential material can be accepted more than once.