# OAuth2 token replay detected: the same access token was used from two different IP addresses within a short time window

- **ID:** `security/oauth2-token-replay-detected`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `OAUTH2_TOKEN_REPLAY`
- **Verification:** ai_generated
- **Fix Rate:** 75%

## Root Cause

An attacker has stolen a valid access token and is using it from a different IP address, or a legitimate user's token is being used from multiple locations due to a misconfigured proxy or VPN.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Keycloak 22.0.0 | active | — | — |
| Okta 16.0.0 | active | — | — |
| Auth0 3.0.0 | active | — | — |
| Spring Security OAuth2 6.2.0 | active | — | — |

## Workarounds

1. **Implement token binding by issuing tokens that are bound to the client's TLS session or device fingerprint. For example, use JWT 'cnf' claim with a certificate thumbprint.** (80% success)
   ```
   Implement token binding by issuing tokens that are bound to the client's TLS session or device fingerprint. For example, use JWT 'cnf' claim with a certificate thumbprint.
   ```
2. **Use short-lived access tokens (e.g., 5 minutes) and refresh tokens with rotation to minimize the window for replay attacks. Configure your identity provider accordingly.** (85% success)
   ```
   Use short-lived access tokens (e.g., 5 minutes) and refresh tokens with rotation to minimize the window for replay attacks. Configure your identity provider accordingly.
   ```
3. **Monitor and alert on suspicious token usage patterns, such as rapid IP changes, and automatically revoke the token and require re-authentication.** (70% success)
   ```
   Monitor and alert on suspicious token usage patterns, such as rapid IP changes, and automatically revoke the token and require re-authentication.
   ```

## Dead Ends

- **** — Blocking the IP address of the second request is ineffective because attackers often use rotating IP addresses or proxies, and it may also block legitimate users behind NAT. (50% fail)
- **** — Increasing the time window for replay detection may reduce false positives but also gives attackers more time to use the stolen token, increasing the risk. (60% fail)
- **** — Disabling replay detection entirely removes the security control, leaving the system vulnerable to token theft and replay attacks. (90% fail)