Submitted by AkshaySrivastav, also found by adriro, csanuragjain, Tajobin, rbserver, gzeon, immeas, Bauer, and 0xjuicer
The KYCRegistry contract uses signatures to grant KYC status to the users using the addKYCAddressViaSignature function.
However this function does not prevent replaying of signatures in the case where KYC status was revoked from a user.
This function could be exploited in the case when these conditions are true:
In the abovementioned conditions, the malicious user can submit the original signature again to the addKYCAddressViaSignature function which will forcefully grant the KYC status to the malicious user again.
It should also be noted that due to this bug until the deadline has passed, the privileged accounts cannot revoke the KYC status of a KYC granted user. This can result in unwanted moving of funds by the user in/out of Ondo protocol.
Test file created BugTest.t.sol and was run by forge test --mp ./forge-tests/BugTest1.t.sol
A nonce mapping for message signers can be maintained; the value of which can be incremented for every successful signature validation.
A more detailed usage example can be found in OpenZeppelins EIP-2612 implementation. 
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/extensions/ERC20Permit.sol#L90>
ali2251 (Ondo Finance) disagreed with severity and commented:
Trust (judge) decreased severity to Medium
