Yamcs is a mission‑control framework. In earlier releases before 5.12.7, the authentication endpoint POST /auth/token in the yamcs-core module does not enforce rate limiting, account lockout, or failed‑attempt throttling, allowing an unauthenticated remote attacker unlimited password‑guessing attempts against any user account, thereby significantly increasing the risk of successful brute‑force attacks.

Affected products are Yamcs core libraries, particularly the authentication component in yamcs-core. The vulnerability exists in version 5.12.6 and earlier releases; it is fixed in releases 5.12.7 and 5.13.0.

The CVSS base score of 6.5 indicates a medium severity. The EPSS score of 2% suggests a modest but non‑negligible exploitation likelihood. The lack of rate limiting makes the attack surface readily exploitable. The vulnerability is not listed in CISA KEV, so organizations should consider patching promptly. An attacker can exploit the endpoint over the network without authentication, performing arbitrary login attempts until a correct credential is found.