KemalIdentity::Sessions::RememberReplayed

An already-spent token was presented again.

This is the theft signal. A remember-me token is single-use, so the legitimate holder never presents one twice: they hand over their token, get a successor, and forget the old one. A second presentation means two parties hold the same token — which is what a stolen cookie looks like from the server's side.

Which of the two is the thief is unknowable, and that is fine. Revoking the whole family ends both, and the real user logs in again with a password. The thief cannot.