CVE-2026-44596: Yamcs Authentication Endpoint Lacks Rate Limiting

Summary

The Yamcs authentication endpoint does not limit the number of login attempts, making it vulnerable to brute-force attacks. This means an attacker can try many passwords without being blocked. To protect your Yamcs instance, consider implementing rate limiting or account lockout features to prevent such attacks.

What to do

Update yamcs org.yamcs:yamcs-core to version 5.12.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	yamcs	org.yamcs:yamcs-core	< 5.12.7 Fix: upgrade to 5.12.7
–	yamcs	yamcs	< 5.12.7
–	spaceapplications	yamcs	< 5.12.7 `cpe:2.3:a:spaceapplications:yamcs::::::::`

Original title

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked a...

Original description

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

ghsa CVSS3.1 6.5

Vulnerability type

CWE-307

https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4
https://github.com/advisories/GHSA-w5r6-mcgq-7pq4
https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83 x_refsource_MISC
https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 x_refsource_MISC
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 x_refsource_MISC