Authentication Bypass in Yamcs via Brute Force

Executive Summary

CVE-2026-44596 is a vulnerability in Yamcs, a mission control framework, affecting versions prior to 5.12.7 and 5.13.0. The authentication endpoint POST /auth/token lacked rate limiting, account lockout, or failed-attempt throttling, allowing unauthenticated remote attackers to perform unlimited password-guessing attempts against any user account. This significantly increases the risk of successful brute-force attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor the POST /auth/token endpoint for unusually high request rates from a single IP address. Check for repeated 429 Too Many Requests responses or failed login attempts. Use tools like curl to test the endpoint: curl -X POST http://<yamcs-server>/auth/token -d '{"username":"test","password":"test"}' to observe response times and status codes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to repeatedly attempt guessing passwords for any user account without restrictions. This could lead to unauthorized access if weak or common passwords are used. The lack of rate limiting means attackers can automate and execute a high volume of attempts quickly, increasing the likelihood of a successful breach.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to insufficient authentication security controls. GDPR requires appropriate technical measures to ensure data protection, including protection against brute-force attacks that could lead to unauthorized access. HIPAA mandates safeguards to protect electronic protected health information, which could be compromised through successful brute-force attacks on authentication endpoints.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Yamcs to version 5.12.7 or 5.13.0 or later. Configure the new rate-limiting option maxAuthRequestsPerSecond (default 5) in the Yamcs server settings. Monitor logs for 429 responses and failed login attempts to identify brute-force attacks.

Useful 0 Not Useful 0