This is a textbook padding oracle vulnerability in Eclipse Milo's OPC UA implementation, but the location of the oracle is what makes it operationally distinctive. The ActivateSession handshake — the normal authentication flow — is returning observably different responses when RSA PKCS#1 v1.5 padding validation fails versus when credentials are invalid. An attacker who can observe these differences (whether on-path or network-adjacent in ICS environments) can decrypt captured tokens offline by querying the ActivateSession endpoint repeatedly, each query revealing one byte of the plaintext through padding validity feedback.
The Basic128Rsa15 algorithm choice is not the root cause — it's the expected legacy algorithm for OPC UA compatibility. The actual failure is that the RSA decryption layer's padding validation result is propagating outward as an observable difference at the application layer. This is almost certainly debugging infrastructure that survived into production: developers implementing authentication handlers naturally trace through 'padding valid?' then 'credentials valid?' and surface those distinct states during development. The secure pattern requires absorbing the padding validation result entirely and returning a single, identical response class for all authentication failures.
When assessing the patch, you need to determine whether it addresses the oracle at the application layer (normalizing all failures into identical messages) or at the cryptographic layer (using constant-time RSA operations that eliminate timing variance). The distinction matters: even if response messages are normalized, the underlying RSA PKCS#1 v1.5 unpadding routine has measurable timing variance depending on where in the padding structure validation fails. A statistical timing oracle can remain exploitable without any observable difference in response content. The patch diff on the RSA decryption path is more informative than the CVE notes for determining whether constant-time operations were introduced.
In ICS and OT deployments, the 'on-path' prerequisite in the CVSS vector may understate the real threat. OPC UA servers often share networks with PLCs, historians, and DMZ'd assets where an attacker's positioning is a lower bar than traditional MITM. Treat this as network-adjacent exploitable in those environments, not just on-path.