The AMMOS Instrument Toolkit GUI prior to version 2.5.1 contains a missing authentication check in Sessions.create(). Any network attacker can request a session without providing credentials, after which the attacker may invoke handle_cmd() to dispatch arbitrary commands directly to the AIT command bus. This flaw constitutes a full authentication bypass (CWE‑306) and enables complete control over spacecraft operations without authorization.

The vulnerability affects all releases of NASA‑AMMOS AIT‑GUI earlier than version 2.5.1; any deployment of those versions that exposes Sessions.create() via the network is susceptible.

With a CVSS score of 9.3 the issue is rated critical. The EPSS score is below 1%, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is remote network; an attacker only needs network reachability to the GUI service to obtain a session and issue commands, with no prerequisite authentication.