CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb	Patch
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/183	Issue Tracking Patch Vendor Advisory
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En las versiones de Eclipse Milo 0.6.0 hasta la 1.1.4, el procesamiento de tokens de nombre de usuario devuelve errores distinguibles para relleno RSA PKCS#1 v1.5 no válido y otras fallas de autenticación, permitiendo a un atacante en la ruta que captura el token de nombre de usuario cifrado con ’Basic128Rsa15’ de una víctima usar solicitudes ’ActivateSession’ repetidas no autenticadas como un oráculo de relleno, recuperar la contraseña de la víctima y autenticarse con las credenciales recuperadas.

Information

Published : 2026-08-04 13:18

Updated : 2026-10-23 23:10

NVD link : CVE-2026-60007

Mitre link : CVE-2026-60007

CVE.ORG link : CVE-2026-60007

JSON object : View

Products Affected

eclipse

milo

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-60007", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60007", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T14:19:31.655624Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse Milo", "versions": [{"status": "affected", "version": "0.6.0", "versionType": "semver", "lessThanOrEqual": "1.1.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-04T13:18:55.427", "references": [{"url": "https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fb", "tags": ["Patch"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/183", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials."}, {"lang": "es", "value": "En las versiones de Eclipse Milo 0.6.0 hasta la 1.1.4, el procesamiento de tokens de nombre de usuario devuelve errores distinguibles para relleno RSA PKCS#1 v1.5 no v\u00e1lido y otras fallas de autenticaci\u00f3n, permitiendo a un atacante en la ruta que captura el token de nombre de usuario cifrado con \u2019Basic128Rsa15\u2019 de una v\u00edctima usar solicitudes \u2019ActivateSession\u2019 repetidas no autenticadas como un or\u00e1culo de relleno, recuperar la contrase\u00f1a de la v\u00edctima y autenticarse con las credenciales recuperadas."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "668DDB9F-3657-40AE-A2FC-0621FF46FA62", "versionEndExcluding": "1.1.5", "versionStartIncluding": "0.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}