CVE-2026-55549: Yamcs has Reflected XSS in the URL of the Authorize Endpoint

Attack type: 

Unauthenticated remote 

Impact:

Attackers can execute arbitrary JavaScript in a user’s browser, including obtaining a user’s session token and refresh token.

Affected components: authorize.html, AuthHandler.java, HandlerContext.java

A Reflected Cross-Site Scripting vulnerability exists in Yamcs <=5.8.6, allowing an attacker to execute arbitrary JavaScript in a Yamcs user’s browser. This vulnerability can be exploited to exfiltrate a logged-in user’s access token and send it to a remote server, leading to the takeover of the user’s account.

Using a specially crafted URL, you are able to execute a JavaScript alert() call in the browser:

You then use JavaScript to obtain the user’s cookies and display them in the alert:

Finally, use the fetch function to send the user’s cookies to a remote server which we controlled:

Now you can set these cookies in our own browser and login to Yamcs as the user.

Steps to Reproduce

1. Start Yamcs
2. Login as a user
3. In a terminal, start a netcat listener:

nc -nlvp 8888

4. Paste the following URL payload in the browser