https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T04:46:39.911058+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-55549 fkie_cve-2026-55549 2026-10-03T04:46:39.934706+00:00

Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4.

 https://vulnerability.circl.lu/vuln/ghsa-rxpg-wjf8-qv9c GHSA-rxpg-wjf8-qv9c — Yamcs has Reflected XSS in the URL of the Authorize Endpoint 2026-10-03T04:46:39.934790+00:00

Affected: Maven: org.yamcs:yamcs-core

### Attack type:  Unauthenticated remote

### Impact: Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token.

### Affected components: authorize.html, AuthHandler.java, HandlerContext.java

A Reflected Cross-Site Scripting vulnerability exists in Yamcs <=5.8.6, allowing an attacker to execute arbitrary JavaScript in a Yamcs user's browser. This vulnerability can be exploited to exfiltrate a logged-in user's access token and send it to a remote server, leading to the takeover of the user's account.

Using a specially crafted URL, you are able to execute a JavaScript `alert()` call in the browser:

<img width="1794" height="816" alt="image" src="https://github.com/user-attachments/assets/4a5b6aa4-bceb-4b3d-bc5d-3dac0895ff2e" />

You then use JavaScript to obtain the user's cookies and display them in the alert:

<img width="1794" height="1290" alt="image" src="https://github.com/user-attachments/assets/6c6d2837-db77-409a-a66d-0d2e4edd5435" />

Finally, use the `fetch` function to send the user's cookies to a remote server which we controlled:

<img width="2370" height="1025" alt="image" src="https://github.com/user-attachments/assets/2989fc79-6ca0-4256-afc4-71d44d9923b8" />

Now you can set these cookies in our own browser and login to Yamcs as the user.

## Steps to Reproduce 1. Start Yamcs 2. Login as a user 3. In a terminal, start a netcat listener:

``` nc -nlvp 8888 ```

4. Paste the following URL p…