AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a val…

AMMOS Instrument Toolkit (AIT) GUI versions before 2.5.1 contain a critical missing authentication vulnerability tracked as CVE-2026-60112. An unauthenticated network attacker can call Sessions.create() without any credential check to obtain a valid session. Once a session is established, the attacker can invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus. There is no authentication gate between session creation and command dispatch, making the attack chain straightforward. This vulnerability affects spacecraft ground systems, posing a significant risk to space mission operations. The issue has been patched in AIT GUI version 2.5.1. References include the official GitHub changelog, the specific fix commit, the release tag, and a VulnCheck advisory. Organizations using AIT GUI should upgrade to version 2.5.1 immediately to mitigate this critical risk.