UserNameIdentityToken Authentication Bypass in Node-OPCUA Implementation

CVE-2026-54155

What is CVE-2026-54155?

The Node-OPCUA implementation for TypeScript and Node.js contains a vulnerability in the UserNameIdentityToken authentication handler prior to version 2.166.0. This vulnerability arises when the server fails to verify that the trailing bytes of a decrypted RSA-OAEP password blob match the current session's serverNonce. This flaw allows an unauthenticated remote attacker to obtain the server's public key through the GetEndpoints method and craft a blob that results in an empty password being accepted by the isValidUser function. Consequently, accounts that permit empty passwords could be compromised. Additionally, the absence of nonce binding allows an attacker to replay a captured UserNameIdentityToken ciphertext in different sessions, further increasing the security risk. The issue is resolved in version 2.166.0.

References