Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Eclipse Milo 0.6.0 to 1.1.4: Passwords can be stolen over the internet

CVE-2026-60007 · published 1 month ago
Summary

If an attacker intercepts a password-protected message sent over the internet, they can use repeated attempts to guess the password, allowing them to steal the password. This affects users of Eclipse Milo versions 0.6.0 to 1.1.4. To protect your users, update to a newer version of Eclipse Milo as soon as possible.

What to do
  • Update eclipse milo to version 1.1.5 or later.
Affected software
VendorProductAffected versions
eclipse foundation eclipse milo <= 1.1.4
eclipse milo >= 0.6.0, < 1.1.5
cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*
Original advisory text
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path att...
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-204Observable Response Discrepancy
Timeline
Published4 Aug 2026
Updated1 Oct 2026
First seen4 Aug 2026
Sources
CVE-2026-60007 · NVD
CVE-2026-60007 · MITRE
CVE-2026-60007 · OSV
Track software like this
Free during beta