A security researcher has disclosed three distinct vulnerabilities in YAMCS, an open-source telemetry software system used for spacecraft and satellite command operations, all patched in the latest 5.12.7 release.
Daniel Miranda Barcelona (Excal1bur) found that the authentication endpoint POST /auth/token in yamcs-core lacked any rate limiting, account lockout, or failed attempt throttling. The complete absence of these basic controls meant an unauthenticated attacker could make unlimited password-guessing attempts against any user account. In testing, 20 attempts executed in 0.07 seconds with no rate limiting enforced. The vulnerability is tracked as CVE-2026-44596 with a CVSS score of 5.3 (Medium).
The root cause was straightforward. The AuthHandler.java file processed authentication requests with “no throttle, no failed attempt counter, no lockout.“ Neither the official quickstart guide nor the documentation provided guidance on configuring rate limiting, leaving every default deployment exposed.
The fix requires implementing throttling on the /auth/token endpoint, tracking failed attempts per IP address, and blocking further attempts after 10 failures within a 15-minute window. If you’re self-hosting YAMCS, upgrading to version 5.12.7 or later is the move. For environments where YAMCS faces the public internet, this vulnerability could allow relatively easy brute-force attacks against privileged accounts.
