CVE-2026-44596 — YAMCS No Rate Limiting on Authentication Endpoint

Summary

The authentication endpoint POST /auth/token in yamcs-core lacks any form of rate limiting, account lockout, or failed attempt throttling. An unauthenticated remote attacker can perform unlimited password guessing attempts against any user account.

Vulnerability Details

POST /auth/token accepts grant_type=password requests without any throttling mechanism. The endpoint returns HTTP 401 for invalid credentials indefinitely — never HTTP 429 — allowing automated brute-force at full network speed.

Proof of Concept

# Usage: ./poc.sh [target] [username] [attempts]
chmod +x poc.sh
./poc.sh http://localhost:8090 operator 20

Expected output on vulnerable instance:

Attempt 1:  HTTP 401
Attempt 2:  HTTP 401
...
Attempt 20: HTTP 401
[!!!] VULNERABLE: 20 attempts completed, no rate limiting

Impact

An unauthenticated attacker with network access to the YAMCS server can brute-force user credentials without restriction, limited only by network bandwidth.

YAMCS is used as mission control software in space missions including ESA's OPS-SAT and other ground station deployments.

Fix

Upgrade to yamcs-core >= 5.12.7.

Timeline

Researcher

Daniel Miranda Barcelona (Excal1bur)

• GitHub: https://github.com/ex-cal1bur
• LinkedIn: https://linkedin.com/in/daniel-miranda-barcelona
• Blog: https://thedumpster.es