CVE-2026-60007

HighCVSS 7.4/10Last modified Oct 23, 2026

Description

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-204

Affected software

Vendor	Product	Versions
Eclipse Foundation	Eclipse Milo	>= 0.6.0, <= 1.1.4

References

https://github.com/eclipse-milo/milo/commit/db59fae993a3a1bc66fffc8a2796d444b40285fbPatch
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/183Issue Tracking, Patch, Vendor Advisory
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598Issue Tracking, Vendor Advisory

Timeline

Published: Aug 4, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-600083.5Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization CVE-2026-600098.8In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled CVE-2026-60018.8Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers CVE-2026-600106.5Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a r CVE-2026-600115.3Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the CVE-2026-600186.5Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a ti CVE-2026-60028.8Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Technologies Inc. Divv CVE-2026-600216.5Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation c CVE-2026-600237.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1.CVE-2026-600249.8Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior vers CVE-2026-600258.8Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 h CVE-2026-600268.9Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder P