CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-60007: Observable Response Discrepancy

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

PT-2026-67696

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 0.6.0 through 1.1.4 Description Username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures. This allows an on-path attacker who captures a victim's...