# OAuth2 refresh token replay detected: same refresh token used more than once

- **ID:** `security/oauth2-token-replay-via-refresh-token`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `invalid_grant`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

OAuth2 refresh token is not rotated after each use, allowing an attacker who steals the token to reuse it indefinitely and obtain new access tokens.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OAuth 2.0 RFC 6749 | active | — | — |
| Spring Security OAuth2 2.5.x | active | — | — |
| Keycloak 21.0.x | active | — | — |
| Auth0 Node.js SDK 2.0.0 | active | — | — |
| Okta .NET SDK 3.0.0 | active | — | — |

## Workarounds

1. **Implement refresh token rotation: issue a new refresh token with each access token refresh and invalidate the old one. Example: In Spring Security OAuth2, set `refreshTokenRotationEnabled=true` in authorization server config.** (90% success)
   ```
   Implement refresh token rotation: issue a new refresh token with each access token refresh and invalidate the old one. Example: In Spring Security OAuth2, set `refreshTokenRotationEnabled=true` in authorization server config.
   ```
2. **Use refresh token expiration with a short TTL (e.g., 15 minutes) combined with rotation, and require re-authentication after expiry.** (85% success)
   ```
   Use refresh token expiration with a short TTL (e.g., 15 minutes) combined with rotation, and require re-authentication after expiry.
   ```
3. **Add a client-side nonce or binding to refresh token to tie it to a specific device or session, preventing cross-device replay.** (75% success)
   ```
   Add a client-side nonce or binding to refresh token to tie it to a specific device or session, preventing cross-device replay.
   ```

## Dead Ends

- **** — Longer expiration gives attackers more time to exploit stolen tokens; does not address the fundamental replay vulnerability. (95% fail)
- **** — Blacklists are hard to maintain in distributed systems and require real-time synchronization; attackers can still replay before blacklisting. (70% fail)
- **** — Rate limiting may block legitimate users and does not prevent a single replay attack; attacker can still use the token once before rate limit kicks in. (85% fail)