CVE-2023-41890

Allows detection of capture-replay attacks by showing the replayed logon's timestamp as the last logon.

Protects against replay of captured session tokens or credentials by requiring authenticated, fresh session channels.

Wireless link protections commonly incorporate replay protection, reducing the exploitability of capture-replay weaknesses.

Accurate synchronized time enables tight timestamp windows that directly limit capture-replay windows in authentication protocols.

Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.

Proper identity management reduces alternate-name collisions but does not guarantee canonicalization inside the auth decision.

Strong authentication mechanisms directly prevent name-based bypass when they enforce canonical name checks.

Protecting and verifying identity assertions prevents replay of captured authentication material.

Authorization policy enforcement assumes correct identity; the weakness occurs before policy is applied.

Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.

A.5.15 only requires defining and documenting an access control policy plus requirements; it does not itself enforce rules or stop alternate-name authentication bypasses from being exploitable.

A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it has no bearing on a product that authenticates by name but fails to canonicalize or check alternate names for the same resource/actor, so the weakness remains present and exploitable.

Proper management of authentication credentials can include rules against duplicate or alias identities.

A.5.18 governs the provisioning, review, and revocation of already-granted access rights to authenticated identities; it does not address or stop the distinct flaw in which authentication logic accepts an alternate name that bypasses the check.