Yamcs <=5.8.6 - Cross-Site Scripting
CVE-2026-55549
Verified
Description
Yamcs < 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirect_uri parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL.
Severity
Medium
CVSS Score
6.5
Exploit Probability
1%
Affected Product
yamcs
Published Date
September 11, 2026
Template Author
str4k3r
CVE-2026-55549.yaml
6.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-55549
CWE ID:
cwe-79
Remediation Steps
Update to version 5.9.4 or later.