Claude Session Cookie Replay Without Fresh MFA/SSO Challenge

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects instances where a Claude session token is reused from a new IP address without the completion of an MFA challenge, indicating a potential session hijacking or session theft attempt.