CVE-2026-79954 describes a missing authentication vulnerability (CWE-306) in NASA CryptoLib 1.5.0. Specifically, in the Telecommand receive path, the software selects the Security Association for Secure Data Link Services (SDLS) processing solely based on the Security Parameter Index (SPI) field of the incoming frame. However, it fails to verify that the selected SA is authorized for the frame's Global Virtual Channel Identifier (GVCID). This can lead to an authentication downgrade, potentially allowing unauthorized commands or data to be processed.

The vulnerability has a high severity CVSS score of 8.7, indicating a significant risk. Because the authentication check is missing for critical functions, an attacker could exploit this flaw to bypass security controls in the Telecommand receive path, potentially leading to unauthorized command execution or data manipulation within NASA CryptoLib 1.5.0. No known exploits are reported in the wild at this time.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected component and monitor for updates from NASA regarding a security patch or mitigation instructions.