CVE-2026-54155

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and forge a blob whose little-endian length produces an empty password passed to isValidUser, compromising accounts that accept an empty password. Missing nonce binding also allows a captured UserNameIdentityToken ciphertext to be replayed in another session, and SecurityMode=None removes the separate client-signature safeguard. This issue is fixed in version 2.166.0.

• CWE-347

• https://github.com/node-opcua/node-opcua/commit/c6b05738682f5c8d70b1ea275c881f01a1cd9787
• https://github.com/node-opcua/node-opcua/releases/tag/v2.166.0
• https://github.com/node-opcua/node-opcua/security/advisories/GHSA-mq36-523m-x7vv

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5414A security flaw has been discovered in Newgen OmniDocs up to…5.5
• CVE-2026-54147http4k is a functional toolkit for Kotlin HTTP applications.…6.5
• CVE-2026-54148http4k is a functional toolkit for Kotlin HTTP applications.…8.1
• CVE-2026-54149MaxKB is an open-source AI assistant for enterprise. Prior t…8.8
• CVE-2026-5415The WP Captcha PRO (the premium version of the Advanced Goog…8.8
• CVE-2026-54150next-video is a library for adding video to Next.js applicat…6.9
• CVE-2026-54156node-opcua is an OPC UA implementation for TypeScript and No…7.5
• CVE-2026-54157LobeHub is a work-and-lifestyle space to find, build, and co…9
• CVE-2026-54158SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-54159PrestaShop ps_facetedsearch is a module that adds layered na…10
• CVE-2026-5416Due to the improper neutralization of special elements used …8.8
• CVE-2026-54163secure_headers manages application of security headers with …4.7