CVE-2026-60007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-60007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-60007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-60007
Published
2026-08-04T11:55:41.934Z
Modified
2026-08-07T08:11:20.650698Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60007.json",
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-204"
    ]
}
References

Affected packages

Git / github.com/eclipse-milo/milo

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-milo/milo
Events
Introduced
9fd8a23ae26263ccd8045d02eae0f9466d06207b
Fixed
8e84cd7d0d8e6eb787f89c5c1319b885d666fe4b
Fixed
db59fae993a3a1bc66fffc8a2796d444b40285fb
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "fixed": "1.1.5"
        }
    ]
}

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "188038620164195837172724250504128934592",
                "313725402404179413707801732315064160383",
                "174189838204593329924430158058042183021",
                "92976993461596416496179529802714400877",
                "325648704022695269325431979808215788526",
                "204377614989667269908249366734680576487",
                "306443133631130654851296892338951030692",
                "32121111155150230312609566674328984955",
                "289126182831460240475552355437788753873",
                "159474457762935532283760957354746280646",
                "80036798617402023978253713751137098654",
                "239450639551906950097467062948004833904",
                "147744115197355298704241929874792473093",
                "53651255250967838108691819095777444210",
                "65408316690245831584872861934383373508",
                "330245448386247958587031147317704006939",
                "199043615714506734474874207008824320564",
                "37298628911085111318371831646241554057",
                "85735462286049278101305306667562845582",
                "115850433468480543422260608487363121551",
                "272662139324495789672511133395077772258",
                "9856600876556770388788353611387178022",
                "293318505528894195345824227769867045938",
                "276353078343930987834036964655688038205",
                "285335048463807311787155757188440571607",
                "165691663660402270608497372296727821998",
                "101057757502538469984594688990084563501",
                "42838684346516863406153471598196211353",
                "133489790443055684326469534437019282720",
                "317441932488366966096213128874335756833",
                "101057757502538469984594688990084563501",
                "42838684346516863406153471598196211353",
                "133489790443055684326469534437019282720",
                "317441932488366966096213128874335756833",
                "101057757502538469984594688990084563501",
                "42838684346516863406153471598196211353",
                "133489790443055684326469534437019282720",
                "317441932488366966096213128874335756833",
                "165059933584994428925489895991186585987",
                "168560309197445974689688641441095658504",
                "321828106753128133428050090045631068736",
                "30996199634324163653539730920374120914",
                "203844665695456400039454503563028777279",
                "262764846853184486922307208201264640036",
                "233179985430821918356078812143903307164",
                "189373587110238860662539933434300009711",
                "184145499983898605309122938496523371031",
                "62763012220476478682608075812964904198",
                "243465781637687491818405089391953700919",
                "264993416677716175263627978784873413468",
                "152979523692811202126572311111448276654",
                "309090487231672123053600503286938804974",
                "265368007230967694145766620978714314456",
                "178077621297239138169416055602771191687",
                "161303987417423812887890045207214505431",
                "213416944534502897734026662962705234955",
                "129264700821380776079161339734594930928",
                "258207802322873659314370327748967681409",
                "9908359087167906314475452342876350728",
                "263073326900592375592170874286200412687",
                "291235981523383231013849431143466093403"
            ]
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/test/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidatorTest.java"
        },
        "id": "CVE-2026-60007-0a64a187"
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 2187.0,
            "function_hash": "180410082158357973447769633828823053638"
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "validateUsernameToken",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidator.java"
        },
        "id": "CVE-2026-60007-42ab9f06"
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "131016304263248897454000357586276693754",
                "157324366710991846709216432786946980501",
                "41972015933479412832614782082630891488",
                "232216161256023952521179730945785224003",
                "114565511718873093061850948704224158034",
                "132744879109487716509273688997043896288",
                "2505252692087267907510452191872402790",
                "87720874174975589605635586667949339436",
                "177203493879804058235606726056788041517",
                "310756794546015147907266946160307502241",
                "130317574957701579568706702659059613444",
                "109958502835532703871617751534089722174",
                "210432811724585211610917572423290717926"
            ]
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidator.java"
        },
        "id": "CVE-2026-60007-65c46cee"
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 306.0,
            "function_hash": "41171591439275596444371461401063538816"
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "shortEncryptedTokenDataReturnsIdentityTokenInvalid",
            "file": "opc-ua-sdk/sdk-server/src/test/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidatorTest.java"
        },
        "id": "CVE-2026-60007-966f44c0"
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 196.0,
            "function_hash": "76652707952019602826318902608411804908"
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "encryptedToken",
            "file": "opc-ua-sdk/sdk-server/src/test/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidatorTest.java"
        },
        "id": "CVE-2026-60007-a8b8bde3"
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 416.0,
            "function_hash": "245791296280875700280821784665540048770"
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "wrongEncryptedPasswordWithValidNonceReturnsUserAccessDenied",
            "file": "opc-ua-sdk/sdk-server/src/test/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidatorTest.java"
        },
        "id": "CVE-2026-60007-bcc401b1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 324.0,
            "function_hash": "182104509600446106153505008042589760093"
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "emptyEncryptedPasswordWithoutNonceReturnsIdentityTokenInvalid",
            "file": "opc-ua-sdk/sdk-server/src/test/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidatorTest.java"
        },
        "id": "CVE-2026-60007-c754dd0b"
    },
    {
        "signature_type": "Function",
        "digest": {
            "length": 350.0,
            "function_hash": "36221845690550757604480720507175042330"
        },
        "source": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb",
        "deprecated": false,
        "signature_version": "v1",
        "target": {
            "function": "emptyEncryptedPasswordWithWrongNonceReturnsIdentityTokenInvalid",
            "file": "opc-ua-sdk/sdk-server/src/test/java/org/eclipse/milo/opcua/sdk/server/identity/AbstractUsernameIdentityValidatorTest.java"
        },
        "id": "CVE-2026-60007-e3aa1966"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-60007.json"
vanir_signatures_modified 
"2026-08-07T08:11:20Z"