CVE-2026-60007
CriticalCVSS 9.1Summary
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated ActivateSession requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
Risk Assessment
An attacker can recover user passwords and gain unauthorized access to systems using Eclipse Milo, potentially leading to confidentiality and integrity breaches.
Recommendation
Immediately upgrade Eclipse Milo to a version newer than 1.1.4 that fixes the information leak through padding errors.
Original NVD description (English source)
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.