Description
Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions.
Affected versions: <= 2.165.0 Tested version: 2.165.0 CVSS Score: 8.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.165.0
References
Could your website be exposed too?
SmartScanner can check your website for node-opcua missing nonce verification in UserNameIdentityToken authentication and gives you actionable findings to investigate.
Start a free scanRelated Issues
- node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS - CVE-2026-54156
- node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion - CVE-2026-68904
- OneUptime WhatsApp Webhook Missing Signature Verification - CVE-2026-33143
- Uncontrolled Resource Consumption in node-opcua - CVE-2022-21208
You might also like:
See something that needs correcting? Let us knowUpdated August 20, 2026