CVE-2026-44596

Katalog CVE

CVSS 9.8 · Critical EPSS 2,1%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada spaceapplications yamcs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4 exploit · advisory vendor
• https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83 patch
• https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc patch
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 release notes
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 release notes