Loading vulnerability…
CVE-2026-54155 is an authentication flaw in node-opcua affecting UserNameIdentityToken processing. The implementation fails to verify that the trailing bytes of the decrypted password blob match the expected session nonce before extracting and accepting the password value. As a result, an attacker can craft a token whose decrypted password field is interpreted as an empty string and can also replay previously captured authentication tokens across sessions because the session-binding nonce is not enforced. The issue breaks the intended freshness and integrity guarantees of the OPC UA username/password authentication flow and can permit unauthorized authentication under affected configurations.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.