CVE-2026-16459 in Oberon PSA Crypto
Summary
by MITRE • 08/13/2026
Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
A padding oracle attack vulnerability exists within the Oberon microsystem AG's Oberon PSA Crypto library affecting all versions from 1.0.0 through 2.1.0, representing a critical security flaw that permits adversaries to recover encrypted plaintext data through carefully crafted timing measurements of RSA PKCS#1 v1.5 decryption operations. This vulnerability falls under the CWE-209 weakness category, specifically addressing information exposure through implementation errors in cryptographic protocols and demonstrates how subtle timing differences during cryptographic operations can leak sensitive information about the underlying data structures.
The technical flaw exploits the predictable timing behavior of the RSA PKCS#1 v1.5 decryption process where the library reveals whether padding validation has failed or succeeded through timing variations that attackers can measure and correlate to determine the actual plaintext content. This occurs because the cryptographic implementation does not employ constant-time operations during the padding verification phase, allowing an attacker to perform a series of decryption attempts and observe timing differences that reveal one bit of information at a time about the encrypted data. The vulnerability operates through the fundamental principle that cryptographic implementations must maintain consistent execution times regardless of input values to prevent timing-based side-channel attacks.
The operational impact of this vulnerability is severe as it enables attackers to systematically recover sensitive data that has been encrypted using RSA PKCS#1 v1.5 padding scheme, potentially compromising confidential information such as session tokens, authentication credentials, or private keys used in secure communications. Attackers can leverage this weakness to perform offline brute force attacks against encrypted content by measuring the time difference between successful and failed decryption attempts, ultimately reconstructing the complete plaintext message through iterative processes that exploit the timing oracle.
Mitigation strategies should focus on upgrading to version 2.1.1 or later of the Oberon PSA Crypto library where the implementation has been corrected to prevent timing variations during padding validation operations. Additionally, organizations should implement constant-time cryptographic algorithms throughout their systems and consider deploying additional security controls such as random delays or hardware-based cryptographic accelerators that eliminate timing side channels. The vulnerability aligns with ATT&CK technique T1552.004 related to credentials from password storage providers and demonstrates the critical importance of proper cryptographic implementation practices as outlined in NIST SP 800-57 guidelines for cryptographic key management and secure algorithm usage.