Brute-force vulnerability in Yamcs Mission Control Server (CVE-2026-44596)

The authentication endpoint `POST /auth/token` in `yamcs-core` (Maven package `org.yamcs:yamcs-core`) lacks rate limiting, account lockout, and failed attempt throttling, allowing an unauthenticated remote attacker to make unlimited password guessing attempts against any user account. This missing rate limiting vulnerability (CWE-307) enables efficient brute-force attacks and carries a CVSS v3 score of 6.5 (Moderate). Public POC available. Affected versions: - < 5.13.0 - < 5.12.7 We recommend updating to: 5.13.0, 5.12.7. CVSS 9.8 · our assessment: act_now Vendor advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4 Details: https://vuln.today/cve/CVE-2026-44596