Executive brief
Yamcs is a mission control framework used for space mission operations and telemetry. A security flaw in its login system allows attackers to make unlimited password guesses without being blocked or slowed down. This significantly increases the risk of unauthorized access to mission control accounts through brute-force attacks, potentially compromising sensitive mission data or operations.
Technical details
The authentication endpoint 'POST /auth/token' in yamcs-core, specifically handled by AuthHandler.java, fails to implement rate limiting, account lockout, or failed-attempt throttling (CWE-307). An unauthenticated remote attacker can send a high volume of authentication requests to guess user passwords without triggering any defensive mechanisms like HTTP 429 (Too Many Requests) responses. This vulnerability allows for efficient automated brute-force attacks against any user account. The issue is resolved in versions 5.12.7 and 5.13.0 by implementing request throttling on the affected endpoint.
Affected products
- Yamcs Yamcs < 5.12.7, < 5.13.0
Timeline
- 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
- 2026-05-21: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD
References
- https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83
- https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
- https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4