CWEweakness
CWE-323 Reusing a Nonce, Key Pair in Encryption
High
Official page ↗
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Likelihood of exploit
- High
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
Nonces should be used for the present occasion and only once.
Common consequences
• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity — Potentially a replay attack, in which an attacker could send the same data twice, could be crafted if nonces are allowed to be reused. This could allow a user to send a message which masquerades as a valid message from a valid user.
Potential mitigations
• [Implementation] Refuse to reuse nonce values.
• [Implementation] Use techniques such as requiring incrementing, time based and/or challenge response to assure uniqueness of nonces.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2024-36289: social networking app reuses a nonce/key pair, allowing MITM attackers to manipulate direct messages
• CVE-2024-21530: Rust package reuses a nonce/key pair when an object is cloned, which resets the random number generation
Related
Observed example · CVE (2)
- CVE-2024-21530 Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump… vulnerability
- CVE-2024-36289 Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. vulnerability
Child of · CWE (1)
- CWE-344 Use of Invariant Value in Dynamically Changing Context weakness
Referenced by CVE · weakness (49)
- CVE-2026-71884 In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted… vulnerability
- CVE-2026-15890 The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in… vulnerability
- CVE-2026-81019 wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. vulnerability
- CVE-2026-81020 wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. vulnerability
- CVE-2026-81341 wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS… vulnerability
- CVE-2026-50577 ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. vulnerability
- CVE-2026-17578 Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage… vulnerability
- CVE-2026-21383 Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to… vulnerability
- CVE-2026-59099 Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext… vulnerability
- CVE-2026-13602 We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access… vulnerability
- CVE-2026-56369 ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the PasskeyEncipherImage method due to AES-CTR nonce reuse. vulnerability
- CVE-2026-55967 AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming… vulnerability
- CVE-2026-12205 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. vulnerability
- CVE-2026-49952 Discuz! vulnerability
- CVE-2026-45028 Astro is a web framework. vulnerability
- CVE-2026-5446 In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. vulnerability
- CVE-2026-3559 Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. vulnerability
- CVE-2026-3099 A flaw was found in Libsoup. vulnerability
- CVE-2026-30785 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient… vulnerability
- CVE-2026-25998 strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. vulnerability
- CVE-2025-59870 HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation ,… vulnerability
- CVE-2025-47345 Cryptographic issue may occur while encrypting license data. vulnerability
- CVE-2025-61739 Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets. vulnerability
- CVE-2025-64767 hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. vulnerability
- CVE-2025-46632 Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information… vulnerability
- CVE-2022-37660 In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. vulnerability
- CVE-2024-11022 The authentication process to the web server uses a challenge response procedure which inludes the nonce and additional information. vulnerability
- CVE-2024-21530 Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump… vulnerability
- CVE-2024-41951 Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. vulnerability
- CVE-2024-36289 Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. vulnerability
Referenced by CWE · has member (1)
- CWE-884 CWE Cross-section view