Padding Oracle Attack exploits a CBC-mode block cipher when a server (the oracle) reveals whether padding is valid.
Allows decryption or forgery without the key (~128 requests/byte).
Mitigations
Authenticated encryption (AES-GCM), constant-time padding validation, Encrypt-then-MAC.