Research by: Ricardo Fradique, Andrzej Olchawa, Tanner Smith, Milenko Starcik (Publication)
Three findings from our continued security research into Yamcs are now documented in public security advisories. Two have assigned CVE identifiers: CVE-2026-62329, covering automatically created administrator credentials, and CVE-2026-55566, covering DOM-based cross-site scripting. The third concerns a bypass of authentication-endpoint rate limiting.
The default-administrator and rate-limiting advisories were published on October 1, 2026, following publication of the DOM XSS advisory on July 14, 2026. Together, they extend our earlier assessments of Yamcs and reinforce why security testing should be an ongoing activity rather than a one-time check.
Building on Previous Assessments
Our Yamcs v5.8.6 Vulnerability Assessment, published in October 2023, examined directory traversal, stored cross-site scripting, and insecure session-cookie handling. Those findings demonstrated risks ranging from arbitrary file access and deletion to exposure of authentication tokens.
Our follow-up, More XSS and Clickjacking in Yamcs v5.8.6, explored stored XSS in the ScriptViewer and Archive Browser, alongside clickjacking. In a controlled demonstration, we showed how a misleading interface could cause a user to unknowingly release telecommands to a spacecraft simulator.
The findings discussed here address different areas: administrator-account creation, extension routing, and the enforcement of authentication rate limits.
| Finding | Identifier | Severity | Patched Versions |
|---|---|---|---|
| Default administrator automatically created at startup | CVE-2026-62329 | Critical – CVSS v3.1: 9.8 | 5.13.6 |
| DOM XSS in extension routing | CVE-2026-55566 | Moderate – CVSS v3.1 4.3 | 5.13.2 and 5.12.8 |
| Weak rate limiting on /auth/token | No CVE listed | Moderate – CVSS v3.1 5.3 | 5.13.6 |
Default Admin User Automatically Added on Startup
When the internal user directory was empty, affected Yamcs versions automatically created an administrator account with hardcoded default credentials. Crucially, this happened even when external authentication providers were configured: account creation occurred before those authentication modules were loaded. The weakness identified for this is CWE-1392: Use of Default Credentials.
Where the default credentials remained usable and the service was reachable, an unauthenticated attacker could obtain superuser access, compromising identity and access management controls and administrative functionality. The advisory identifies versions before 5.13.6 as affected.
Steps to reproduce
- Start a Yamcs instance.
- Navigate to http://localhost:8090
- Login using the admin:admin credentials.
Our recommendation: Alongside upgrading, audit existing local administrator accounts and eliminate default credentials. External authentication should not be treated as proof that no local administrative access path exists.
DOM XSS in Extension Routing
The extension-routing functionality accepted specially crafted input through the/extURL path, allowing arbitrary JavaScript to execute in a user’s browser. An attacker could distribute a malicious URL, including through a phishing message, and trigger the issue when a user opened it. User interaction is required, because this is browser-side script execution, not a server-side code-execution vulnerability.
We recommend replacing unsafe HTML insertion with DOM element creation, validating extension identifiers against registered plugins, and enforcing valid custom-element names. Fixes are available in 5.13.2 and 5.12.8.
Weak Rate Limiting on /auth/token Endpoint
The/auth/tokenendpoint’s rate limiter relied on the client-suppliedX-Forwarded-Forheader. Changing that value between requests allowed an attacker to evade the intended throttling.
This removes a protective barrier against repeated authentication attempts. The advisory identifies potential brute-force and denial-of-service consequences; the bypass does not, by itself, demonstrate successful token guessing or account compromise. Versions before 5.13.6 are affected.
Steps to Reproduce
Run the following command to test the rate limiting feature:
for i in {0..1000};do curl -X POST -H "x-forwarded-for:test" -H 'content-type: application/x-www-form-urlencoded' -d 'grant_type=authorization_code&code=EAXKj3850eIfMA' "http://localhost:8090/auth/token"; doneRun the following command to bypass the rate limits:
for i in {0..1000};do curl -X POST -H "x-forwarded-for:{$i*$i}" -H 'content-type: application/x-www-form-urlencoded' -d 'grant_type=authorization_code&code=EAXKj3850eIfMA' "http://localhost:8090/auth/token"; doneThe recommended approach is to base rate limiting on the actual connection source, potentially combined with account or session identifiers, rather than trusting an arbitrary request header.
Recommended Next Steps
For everyone operating affected deployments, we recommend:
- Upgrade to Yamcs 5.13.6 or a later release containing these fixes to address all three findings.
- Audit local administrator accounts, including deployments using external identity providers.
- Validate extension routing with malformed identifiers and confirm that input is rejected rather than interpreted as HTML.
Security Assessment Is a Continuing Process
Test not only whether a security control exists, but whether it holds under adversarial conditions. For future releases, we recommend explicitly covering first-run account creation, local and external authentication paths, browser-side routing, and the assumptions behind abuse-prevention controls.
