Token replay
Token replay is the unauthorized reuse of a captured security token in an attempt to obtain access or repeat an authenticated operation.
Why possession can matter
A bearer token can be used by whoever possesses it, within the permissions and validity accepted by its recipient. If an attacker obtains a usable token, they may attempt to present it without repeating the original user sign-in. A legitimate application reusing its own access token for several API requests is normal behavior; unauthorized reuse is the security concern.
Success depends on the token, its intended recipient, expiration, permissions, and applicable enforcement. A stolen token is not a ticket to unrestricted access, nor does it bypass MFA in every situation.
Exposure and use are different findings
Start with the API the token was issued for and the period when it could have been accepted. Check the API’s activity records for access during that window. An exposed token tells you access may have been possible; resource logs can help establish what actually happened. The available logs may identify an account or application without identifying the exact token used.
What protection changes
OAuth security guidance recommends sender-constrained access tokens, which require the presenter to prove possession of an associated secret or key. With that protection correctly implemented, stealing the token alone is insufficient. Audience restrictions limit which resource servers should accept a token; they do not by themselves prevent reuse at its intended recipient.
Ask the application owner which protections the actual client and resource support. Check token handling, intended audience, and containment behavior for that integration. After containment, retest the affected access with authorization. Do not assume changing a password immediately invalidated every stolen token.