{
  "id": 5911974,
  "title": "HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs",
  "url": "https://urgent.news/2026/09/06/hmac-proves-origin-not-freshness-replay-attacks-against-signed-apis",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-06T05:02:35.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/roxdavirox/hmac-proves-origin-not-freshness-replay-attacks-against-signed-apis-1e53"
  },
  "original_language": "en",
  "account": "HMAC proves that a request originated from someone who possesses the shared secret, but it does not guarantee the request's freshness. When APIs sign requests without including a timestamp in the signed payload, they are vulnerable to replay attacks. A captured request can be used multiple times, functioning as a standing credential for that action. HMAC-SHA256, a common signing algorithm, is deterministic, meaning that the same key and message always produce the same message authentication code (MAC). This deterministic property is what makes HMAC suitable for origin authentication, but it also allows for replay attacks when there is no freshness field in the signed payload. Signature verification confirms two things: the sender's possession of the secret and the integrity of the message, but it does not confirm when the message was generated or whether it has been processed before. This is a fundamental limitation of HMAC-based authentication schemes. Without a timestamp or nonce in the signed payload, the server has no mechanism to inspect and validate the request's freshness. Attackers can capture valid credentials or requests and replay them at a later time to bypass authentication, a pattern classified by MITRE as CWE-294 (Authentication Bypass by Capture-replay). This exact vulnerability has been identified in various APIs, including RBKmoney, Shopify, python-oauth2, Mattermost Zoom plugin, and Stripe. RBKmoney accepted Apple Pay cryptograms for repeated charges without checking the time, while Shopify accepted payment webhook deliveries without signature verification. python-oauth2 and Mattermost Zoom plugin also suffered from missing nonce validation, allowing OAuth requests to be replayable. Stripe addressed this issue by including a timestamp in the signed payload, enabling the server to validate the request's freshness. Multiple CVEs have been reported due to the lack of timestamp validation in production systems, affecting products such as lakeFS S3 gateway, Open edX LTI provider, SAP HMAC auth, and Mattermost Zoom plugin. These vulnerabilities can lead to significant security risks, including unauthorized access, data manipulation, and system compromise.",
  "summary": "HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs The signature verified. The secret was correct. The payment processed for the fourth time, from a request captured three hours earlier. HMAC proves that a request came from someone who knows the secret. It does not prove when. APIs that sign requests without including a timestamp in the signed payload accept valid replays…",
  "key_points": [
    "HMAC verifies request origin, not freshness",
    "Signed APIs vulnerable to replay attacks",
    "Timestamp inclusion prevents replay vulnerabilities"
  ],
  "editors_take": "The vulnerability of HMAC-based authentication schemes to replay attacks highlights a fundamental limitation that API designers must address by incorporating timestamps or nonces to ensure request freshness and prevent authentication bypass.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}