CVE-2026-44596 Details
Description
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.
A vulnerability exists in the Yamcs mission control framework, specifically in the authentication endpoint POST /auth/token of the yamcs-core component, prior to versions 5.12.7 and 5.13.0. This vulnerability allows an unauthenticated remote attacker to execute unlimited password-guessing attempts on any user account. The lack of rate limiting, account lockout, and throttling of failed attempts significantly heightens the risk of successful brute-force attacks.
Users can update to Yamcs versions 5.12.7 or 5.13.0, both of which include the necessary rate limiting on the authentication endpoint. Instructions for downloading these versions are available on the Yamcs GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| spaceapplications yamcs | < 5.12.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |