CVE-2026-60007 Details
Description
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
A padding oracle vulnerability has been identified in Eclipse Milo versions 0.6.0 through 1.1.4. The issue arises in the processing of username tokens encrypted with the 'Basic128Rsa15' security policy. The server returns different error messages for various authentication failures, including invalid RSA padding. This discrepancy allows an on-path attacker to exploit the vulnerability by capturing an encrypted username token and using it to recover the victim's password through a series of unauthenticated 'ActivateSession' requests. The attacker can then authenticate using the recovered credentials.
Users are advised to avoid using the 'Basic128Rsa15' username policy and to ensure that their servers are configured to return generic error messages for all username-token failures. Additionally, implementing a rate limit on the 'ActivateSession' requests can help mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb | [email protected] | Patch |
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/183 | [email protected] | Issue TrackingPatchVendor Advisory |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598 | [email protected] | Issue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-204 | Observable Response Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse milo | >= 0.6.0, < 1.1.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |