Authentication Flaw in Eclipse Milo Affects RSA Token Processing

CVE-2026-60007

What is CVE-2026-60007?

In multiple versions of Eclipse Milo, a vulnerability exists in the handling of username-token processing. The flaw allows an attacker exploiting distinguishable error messages during RSA PKCS#1 v1.5 padding checks. By capturing the victim's Basic128Rsa15-encrypted username token, the attacker can issue repeated unauthenticated ActivateSession requests, effectively functioning as a padding oracle. This method enables the recovery of the victim's password, thereby allowing the attacker to authenticate with the stolen credentials.

References