Vulnerability · Published Aug 4, 2026 · Assigned by eclipse

CVE-2026-60007

Critical 9.1

In plain English

A critical-severity security flaw in Eclipse Milo from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)9.1Critical

Exploit odds (30 days)0.6%top 53.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

Affected products (as reported)

Vendor	Product	Versions
Eclipse Foundation	Eclipse Milo	0.6.0 – through 1.1.4

Weakness: CWE-204 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References