The vulnerability is a reflected cross‑site scripting flaw in the /auth/authorize endpoint of the Yamcs mission control framework. An attacker can embed malicious JavaScript into the redirect_uri query parameter, which the application renders into authorize.html without escaping. When a legitimate user accesses the crafted URL, the browser executes the attacker’s script. Because the script runs with the user’s session context, it can read the cookie or local storage that holds authentication credentials and exfiltrate them, leading to account compromise.

The flaw affects all Yamcs releases before version 5.9.4. The affected component is the Yamcs core library, which handles HTTP authentication and authorization templates. Users running any preceding minor or major version of Yamcs should consider upgrading. The official fix is available in Yamcs 5.9.4 and later.

The CVSS score of 6.5 classifies it as a moderate severity security risk. No EPSS data is available, so current exploitation probability is unknown; however, because the flaw can be triggered by a benign‑looking link, an attacker can easily craft an exploit in a phishing message or compromised web page. The vulnerability is not listed in CISA KEV, meaning no confirmed exploitation yet. Nevertheless, the attack vector is remote via the web, and the susceptibility to reflective XSS makes it potentially exploitable by an attacker who can entice a user to visit the crafted URL.