A satellite operator’s dashboard is not one system. It is a stack of application programming interfaces, and the credential that opens one spacecraft will often open the rest of the constellation. That was the demonstration Alissa Knight brought to CyberSat 2026.
Knight, chief executive of the security firm Assail, described logging in with a legitimate account scoped to a single satellite, receiving a bearer token, and then directing other spacecraft with the same token.
Authentication is solved, authorization is not
The flaw class is Broken Object Level Authorization, in which an application checks that a user is logged in but never checks that this user may act on this particular object. She told the conference it accounts for most of the API vulnerabilities her tests turn up.
“We do a really good job at authenticating, and a really terrible job at authorization,” she said. Her tool for finding them was a small swarm of AI agents, not a manual review.
Why the same bug keeps coming back
Part of the answer is speed. Code that once took months to write now ships in a day, and agentic coding tools generate more of it than reviewers can follow. The other part is sequencing: security testing still happens after code is written rather than while it is, so an authorization check that was never specified never gets added.
For space operators the consequence is specific. Telemetry requests and commands such as pointing a camera all travel over these interfaces. An authorization gap in the dashboard is an authorization gap on the spacecraft, and it arrives through ordinary cloud software rather than through anything the mission integrator built.
Knight’s advice was to test the interfaces between systems rather than the systems alone, since that is where the trust assumptions live.
