{"id":"CVE-2026-54155","aliases":["EUVD-2026-77619","GHSA-mq36-523m-x7vv"],"status":"published","title":"node-opcua: Missing nonce verification in UserNameIdentityToken authentication","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00424,"percentile":0.37126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2026-08-20T18:35:33Z","modified":"2026-10-28T02:30:22Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"node-opcua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.165.0"}]}]},{"source":"osv","ecosystem":"npm","package":"node-opcua","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.165.0"}]}]}],"products":[{"vendor":"node-opcua","product":"node-opcua"}],"references":[{"url":"https://github.com/node-opcua/node-opcua/security/advisories/GHSA-mq36-523m-x7vv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/node-opcua/node-opcua/commit/c6b05738682f5c8d70b1ea275c881f01a1cd9787","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-mq36-523m-x7vv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54155.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54155","tags":["advisory"]},{"url":"https://github.com/node-opcua/node-opcua","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54155","title":"node-opcua: Missing nonce verification in UserNameIdentityToken authentication","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T16:07:50.461Z","modified":"2026-09-14T16:39:35.824Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-77619","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T16:07:50Z","modified":"2026-09-14T16:39:35Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T17:28:20.0825Z"}],"ghsa":[{"id":"GHSA-mq36-523m-x7vv","title":"node-opcua missing nonce verification in UserNameIdentityToken authentication","description":"**Summary**\nA missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions.\n\n**Affected versions:** \u003c= 2.165.0\n**Tested version:** 2.165.0\n**CVSS Score:** 8.1 (High)\n**CVSS Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L\n**CWE:** CWE-347 Improper Verification of Cryptographic Signature\n\n---\n\n**Root Cause**\n\nIn `packages/node-opcua-server/source/opcua_server.ts` at line 1886-1887, after RSA-OAEP decrypting the UserNameIdentityToken password blob, the server reads a 4-byte little-endian length field and extracts `buff[4 : 4+length]` as the password. It never verifies that the trailing bytes equal `session.nonce`.\n\nThis has two consequences:\n\n1. **Forged empty password:** An attacker who retrieves the server's public key via an unauthenticated `GetEndpoints` call can craft a token where the 4-byte length field equals `serverNonce.length` (32). The server computes `length = 32 - 32 = 0` and calls `isValidUser(username, \"\")`. Any account that accepts an empty password is compromised.\n\n2. **Unconditional replay attack:** Because nonce binding is structurally absent, any captured UserNameIdentityToken ciphertext can be replayed in a different session unconditionally.\n\nThe impact is compounded by a second issue: when the channel uses `SecurityMode=None`, `verifyClientSignature` returns `true` unconditionally (security_policy.ts:697-700), bypassing the channel-level signature check entirely.\n\n---\n\n**Proof of Concept (logic, no exploit code)**\n\n```\n1. GetEndpoints (unauthenticated) → retrieve server public key and RSA token policy\n2. OpenSecureChannel (SecurityMode=None)\n3. CreateSession\n4. Craft plaintext: [0x20, 0x00, 0x00, 0x00]  (readUInt32LE = 32 = serverNonce.length)\n5. RSA-OAEP encrypt with server public key → 256-byte ciphertext\n6. ActivateSession with crafted UserNameIdentityToken\n7. Server decrypts → length = 32 - 32 = 0 → password = \"\"\n8. isValidUser(username, \"\") is called\n```\n\nDynamically confirmed: decryption produces `password = \"\"` with no error and no nonce verification.\n\n---\n\n**Suggested Fix**\n\nAfter decrypting the password blob, verify that `buff.slice(4 + passwordLength)` equals `session.nonce` before extracting the password. Reject the token if verification fails.\n\n---\n\nI am following a 90-day responsible disclosure policy. I am happy to provide additional technical details under embargo. Please confirm receipt at your earliest convenience.\n\nReporter: Stanley Tobias\nDiscovery date: 2026-03-23","status":"published","published":"2026-08-20T18:35:33Z","modified":"2026-08-20T18:36:02Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:41:04.755504Z"}],"nvd":[{"id":"CVE-2026-54155","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T17:17:46.737Z","modified":"2026-09-30T19:38:27.293Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"CVE-2026-54155","title":"node-opcua: Missing nonce verification in UserNameIdentityToken authentication","description":"node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.","status":"published","published":"2026-09-14T16:07:50.461Z","modified":"2026-10-28T02:30:22.781749585Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-mq36-523m-x7vv","title":"node-opcua missing nonce verification in UserNameIdentityToken authentication","description":"**Summary**\nA missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions.\n\n**Affected versions:** \u003c= 2.165.0\n**Tested version:** 2.165.0\n**CVSS Score:** 8.1 (High)\n**CVSS Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L\n**CWE:** CWE-347 Improper Verification of Cryptographic Signature\n\n---\n\n**Root Cause**\n\nIn `packages/node-opcua-server/source/opcua_server.ts` at line 1886-1887, after RSA-OAEP decrypting the UserNameIdentityToken password blob, the server reads a 4-byte little-endian length field and extracts `buff[4 : 4+length]` as the password. It never verifies that the trailing bytes equal `session.nonce`.\n\nThis has two consequences:\n\n1. **Forged empty password:** An attacker who retrieves the server's public key via an unauthenticated `GetEndpoints` call can craft a token where the 4-byte length field equals `serverNonce.length` (32). The server computes `length = 32 - 32 = 0` and calls `isValidUser(username, \"\")`. Any account that accepts an empty password is compromised.\n\n2. **Unconditional replay attack:** Because nonce binding is structurally absent, any captured UserNameIdentityToken ciphertext can be replayed in a different session unconditionally.\n\nThe impact is compounded by a second issue: when the channel uses `SecurityMode=None`, `verifyClientSignature` returns `true` unconditionally (security_policy.ts:697-700), bypassing the channel-level signature check entirely.\n\n---\n\n**Proof of Concept (logic, no exploit code)**\n\n```\n1. GetEndpoints (unauthenticated) → retrieve server public key and RSA token policy\n2. OpenSecureChannel (SecurityMode=None)\n3. CreateSession\n4. Craft plaintext: [0x20, 0x00, 0x00, 0x00]  (readUInt32LE = 32 = serverNonce.length)\n5. RSA-OAEP encrypt with server public key → 256-byte ciphertext\n6. ActivateSession with crafted UserNameIdentityToken\n7. Server decrypts → length = 32 - 32 = 0 → password = \"\"\n8. isValidUser(username, \"\") is called\n```\n\nDynamically confirmed: decryption produces `password = \"\"` with no error and no nonce verification.\n\n---\n\n**Suggested Fix**\n\nAfter decrypting the password blob, verify that `buff.slice(4 + passwordLength)` equals `session.nonce` before extracting the password. Reject the token if verification fails.\n\n---\n\nI am following a 90-day responsible disclosure policy. I am happy to provide additional technical details under embargo. Please confirm receipt at your earliest convenience.\n\nReporter: Stanley Tobias\nDiscovery date: 2026-03-23","status":"published","published":"2026-08-20T18:35:33Z","modified":"2026-08-20T18:48:09.721933Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}