AIKIDO-2026-10748

TL;DR

Affected versions of this package do not validate the expiration of client challenges before generating credentials, which allows expired challenges to be accepted and processed. This behavior enables a replay attack scenario where an attacker can reuse a previously intercepted challenge (e.g., from a WWW-Authenticate header) beyond its intended validity window. Because the client proceeds with credential creation without enforcing freshness, the same challenge can be replayed multiple times to obtain valid credentials or trigger repeated payments.