CVE-2026-60007 in Milo
Summary
by MITRE • 08/04/2026
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists in Eclipse Milo versions 0.6.0 through 1.1.4 where the username-token processing implementation exhibits distinguishable error responses for different authentication failures. The flaw specifically affects the `Basic128Rsa15` security policy which employs RSA PKCS#1 v1.5 padding for encryption. When an attacker intercepts a valid username token encrypted with this policy, they can exploit the distinguishable error messages to perform a padding oracle attack. The vulnerability stems from the server's inconsistent error handling during RSA decryption operations where invalid PKCS#1 v1.5 padding produces different error responses compared to other authentication failures such as incorrect passwords or invalid usernames.
The operational impact of this vulnerability is severe as it allows an on-path attacker to recover victim credentials through repeated authenticated requests. The attacker can repeatedly submit `ActivateSession` requests with the captured encrypted token, observing the server's response differences to determine whether the RSA padding was valid. This process effectively creates a padding oracle that enables the attacker to iteratively decrypt the password portion of the username token. The attack leverages the deterministic nature of PKCS#1 v1.5 padding and the distinguishable error responses from the vulnerable implementation, making it possible to recover the complete password through mathematical analysis of the oracle's responses.
This vulnerability directly maps to CWE-209 Information Exposure Through an Error Message, which describes how error messages can reveal sensitive information about system operations. The flaw also aligns with ATT&CK technique T1566.002 Credential Access: Phishing for Information, as it enables attackers to obtain credentials through network-based attacks rather than traditional phishing methods. Additionally, the vulnerability relates to CWE-310 Cryptographic Issues, specifically addressing weak cryptographic implementations where error handling compromises security. The attack pattern follows the characteristics of a padding oracle attack as described in various cryptographic literature and security frameworks.
Mitigation strategies for this vulnerability include implementing consistent error handling that does not distinguish between different types of authentication failures during RSA decryption operations. The server should return identical error responses regardless of whether the failure occurred due to invalid PKCS#1 v1.5 padding or other authentication issues. Organizations should upgrade to Eclipse Milo versions 1.2.0 and later where this vulnerability has been addressed through improved cryptographic error handling. Alternative security policies such as `Basic256Rsa256` should be considered for applications requiring stronger security guarantees, as they typically implement more robust padding schemes like PKCS#1 v2.1 or OAEP. Network segmentation and encryption of authentication traffic can also provide additional protection layers against on-path attackers attempting to capture username tokens for exploitation.