In Eclipse Milo versions 0.6.0 through 1.1.4, the handling of username tokens encrypted with Basic128Rsa15 is vulnerable to a padding oracle attack due to distinguishable error messages returned for invalid RSA PKCS#1 v1.5 padding versus other authentication failures. An attacker positioned on the network path who captures a victim's encrypted username token can send repeated unauthenticated ActivateSession requests to exploit this vulnerability, enabling them to recover the victim's password and subsequently authenticate as that user.

An attacker with network access who can capture encrypted username tokens can exploit this vulnerability to recover user passwords and gain unauthorized authentication access. This compromises confidentiality and authentication integrity, potentially allowing full account takeover without needing prior credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting network access to the affected service and monitoring for suspicious ActivateSession requests. Avoid using vulnerable versions in sensitive environments.