CVE-2026-54155 in node-opcua
Summary
by MITRE • 09/14/2026
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability resides within the node-opcua library, specifically affecting versions prior to 2.166.0 when operating as an OPC UA server implementation for TypeScript and Node.js environments. The core technical flaw is located in the UserNameIdentityToken authentication handler found in the opcua_server.ts source file. During the authentication process, the system decrypts an RSA-OAEP encrypted password blob sent by a client but fails to perform critical validation checks on the decrypted data structure. Specifically, it does not verify that the trailing bytes of the decrypted payload match the current session's serverNonce. This omission represents a fundamental failure in cryptographic binding and integrity verification within the authentication protocol flow.
The operational impact of this flaw is severe, allowing for both unauthorized access via empty passwords and credential replay attacks. Because the system does validate the length of the password field but neglects to check the nonce suffix, an attacker can manipulate the RSA-OAEP encryption padding or structure such that the resulting little-endian length calculation yields zero bytes for the actual password content. When this forged blob is processed by the isValidUser function, it effectively passes an empty string as the credential. Consequently, any user account configured to accept empty passwords becomes immediately compromised without requiring valid credentials. This bypasses standard authentication mechanisms entirely, granting unauthenticated remote attackers access to protected resources and data within the OPC UA ecosystem.
Furthermore, the absence of nonce binding introduces a significant replay attack vector. In secure communication protocols like OPC UA, nonces are used to ensure that each message is unique and tied to a specific session instance, preventing old or captured messages from being reused by an attacker. Without this verification, an adversary who captures a valid UserNameIdentityToken ciphertext can intercept it and inject it into a different active session. Since the server does not check if the nonce embedded in the token matches the current session's expected value, the system accepts the replayed credentials as legitimate. This allows attackers to hijack sessions or escalate privileges by reusing previously captured authentication tokens across multiple connections.
The risk is further exacerbated when OPC UA security policies are configured with SecurityMode set to None. In this configuration, there is no separate client-signature safeguard applied to messages after encryption. Typically, digital signatures provide an additional layer of integrity and authenticity verification that can mitigate certain types of tampering or replay attacks even if encryption alone might be bypassed. With SecurityMode=None, the system relies solely on the flawed authentication logic described above, leaving it completely exposed to the aforementioned exploits. This combination of missing nonce validation and lack of message signing creates a critical security gap in environments where strong authentication is expected but not technically enforced by the library's default behavior under these specific conditions.
To mitigate this vulnerability, organizations must immediately upgrade node-opcua to version 2.166.0 or later, which includes patches for both the nonce verification logic and the handling of empty password scenarios. Additionally, administrators should review their OPC UA server configurations to ensure that SecurityMode is not set to None in production environments where sensitive data is transmitted. Enforcing strong authentication policies that prohibit accounts with empty passwords is also essential to prevent exploitation even if similar flaws exist in other components or future versions. This issue aligns with CWE-287, which covers Improper Authentication, and specifically relates to the failure to verify cryptographic bindings as described in CWE-345. In terms of offensive security tactics, this vulnerability facilitates Initial Access through credential-based attacks and can be leveraged for Persistence via session hijacking, mapping directly to MITRE ATT&CK techniques T1078 and T1136 respectively within the context of industrial control systems and IoT infrastructure.