Apache APISIX's hmac-auth module can be exploited to replay captured authentication tokens, allowing an attacker to circumvent token expiry and regain access indefinitely. This flaw effectively bypasses the intended authentication controls, leading to unauthorized access. The weakness stems from improper handling of cryptographic tokens, identified as CWE-294.

Minimum impacted product is Apache APISIX provided by the Apache Software Foundation, with vulnerable versions ranging from 3.11.0 through 3.16.0. All installations using hmac-auth in these versions are susceptible until upgraded to the fixed release 3.17.0.

The CVSS v3.1 score is 6.3, indicating moderate severity. EPSS is currently unavailable, so exploitation likelihood is uncertain, but the vulnerability is publicly documented and not yet listed in CISA's KEV catalog. Attackers would need access to a valid token, possibly gained through network sniffing or a compromised client, to replay it; this indicates a more targeted attack scenario rather than a mass exploit. While the risk is moderate, the impact of successful token replay could be significant for systems relying on APISIX for API gateway protection.