Exploit for CVE-2026-44596

Name: Exploit for CVE-2026-44596
Rating: 5 (98 reviews)
2026-05-29 | CVSS 5.8
## https://sploitus.com/exploit?id=26680C7D-63B4-5F68-AA47-63A6A3ADADD4
# CVE-2026-44596 — YAMCS No Rate Limiting on Authentication Endpoint

## Summary

The authentication endpoint `POST /auth/token` in `yamcs-core` lacks any form of rate limiting, account lockout, or failed attempt throttling. An unauthenticated remote attacker can perform unlimited password guessing attempts against any user account.

| Field | Value |
|-------|-------|
| **CVE** | CVE-2026-44596 |
| **Severity** | MEDIUM (CVSS 5.3) |
| **CWE** | CWE-307: Improper Restriction of Excessive Authentication Attempts |
| **Affected** | yamcs-core = 5.12.7`.

## Timeline

| Date | Event |
|------|-------|
| 2026-05 | Vulnerability reported |
| 2026-05-27 | Fix released in yamcs-core 5.12.7 |
| 2026-05-27 | Public advisory published |

## Researcher

**Daniel Miranda Barcelona (Excal1bur)**
- GitHub: [https://github.com/ex-cal1bur](https://github.com/ex-cal1bur)
- LinkedIn: [https://linkedin.com/in/daniel-miranda-barcelona](https://linkedin.com/in/daniel-miranda-barcelona)
- Blog: [https://thedumpster.es](https://thedumpster.es)