Authentication Flaw in Yamcs Mission Control Framework

CVE-2026-44596

What is CVE-2026-44596?

An identified security weakness in the Yamcs mission control framework allows remote attackers to exploit the authentication endpoint, POST /auth/token, without facing any restrictions. This vulnerability enables unauthenticated attackers to conduct limitless password-guessing attempts against user accounts, making successful brute-force attacks significantly more feasible. The issue has been addressed in versions 5.12.7 and 5.13.0, which implement necessary security measures such as rate limiting and account lockout functionality to mitigate the risk of such attacks.

References