{
  "id": "security/oauth2-token-replay-via-refresh-token",
  "signature": "OAuth2 refresh token replay detected: same refresh token used more than once",
  "signature_zh": "OAuth2 刷新令牌重放检测：相同的刷新令牌被多次使用",
  "regex": "Refresh token replay detected|same refresh token used more than once|invalid_grant: token reused",
  "domain": "security",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "OAuth2 refresh token is not rotated after each use, allowing an attacker who steals the token to reuse it indefinitely and obtain new access tokens.",
  "root_cause_type": "generic",
  "root_cause_zh": "OAuth2 刷新令牌在每次使用后未轮换，导致窃取令牌的攻击者可以无限重放以获取新的访问令牌。",
  "versions": [
    {
      "version": "OAuth 2.0 RFC 6749",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Spring Security OAuth2 2.5.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Keycloak 21.0.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Auth0 Node.js SDK 2.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Okta .NET SDK 3.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Longer expiration gives attackers more time to exploit stolen tokens; does not address the fundamental replay vulnerability.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Blacklists are hard to maintain in distributed systems and require real-time synchronization; attackers can still replay before blacklisting.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Rate limiting may block legitimate users and does not prevent a single replay attack; attacker can still use the token once before rate limit kicks in.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Implement refresh token rotation: issue a new refresh token with each access token refresh and invalidate the old one. Example: In Spring Security OAuth2, set `refreshTokenRotationEnabled=true` in authorization server config.",
      "success_rate": 0.9,
      "how": "Implement refresh token rotation: issue a new refresh token with each access token refresh and invalidate the old one. Example: In Spring Security OAuth2, set `refreshTokenRotationEnabled=true` in authorization server config.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use refresh token expiration with a short TTL (e.g., 15 minutes) combined with rotation, and require re-authentication after expiry.",
      "success_rate": 0.85,
      "how": "Use refresh token expiration with a short TTL (e.g., 15 minutes) combined with rotation, and require re-authentication after expiry.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Add a client-side nonce or binding to refresh token to tie it to a specific device or session, preventing cross-device replay.",
      "success_rate": 0.75,
      "how": "Add a client-side nonce or binding to refresh token to tie it to a specific device or session, preventing cross-device replay.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Implement refresh token rotation: issue a new refresh token with each access token refresh and invalidate the old one. Example: In Spring Security OAuth2, set `refreshTokenRotationEnabled=true` in authorization server config.",
    "Use refresh token expiration with a short TTL (e.g., 15 minutes) combined with rotation, and require re-authentication after expiry.",
    "Add a client-side nonce or binding to refresh token to tie it to a specific device or session, preventing cross-device replay."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://datatracker.ietf.org/doc/html/rfc6749#section-1.5",
  "official_doc_section": null,
  "error_code": "invalid_grant",
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.8,
  "resolvable": "true",
  "first_seen": "2023-05-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}