CVE-2025-68620
CriticalSummary
Signal K Server before version 2.19.0 allows an unauthenticated attacker to chain two features to steal JWT tokens: unauthenticated WebSocket request enumeration and unauthenticated polling of access request status.
Risk Assessment
An attacker can steal JWT tokens, potentially leading to unauthorized access to the system and data.
Recommendation
Update Signal K Server to version 2.19.0 or later.
Other vulnerabilities in Signal K Server
See all- CVE-2025-68619High
Signal K Server prior to version 2.19.0 allows administrators to install npm packages via a REST API endpoint. The version parameter accepts arbitrary npm version specifiers including URLs, enabling arbitrary code execution via postinstall scripts. Version 2.19.0 contains a patch.
- CVE-2025-68272High
Signal K Server prior to version 2.19.0 has a DoS vulnerability that allows an unauthenticated attacker to flood the /signalk/v1/access/requests endpoint, causing a 'JavaScript heap out of memory' error and crashing the server. Version 2.19.0 fixes the issue.
- CVE-2026-33950Critical
Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.
- CVE-2025-66398Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.
- CVE-2026-55591Medium
Signal K Server prior to 2.28.0 has a vulnerability in makeRemoteRequest() that accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination. When security is not configured, the endpoints testSignalKConnection, requestAccess, and checkAccessRequest are accessible without authentication, allowing port scanning, exfiltration of cloud metadata and internal service data, and lateral movement.
- CVE-2026-41893High
Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.
- CVE-2026-35038Medium
Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.
- CVE-2026-34083Medium
Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.
- CVE-2026-33951High
Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.
Original NVD description (English source)
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. The first is Unauthenticated WebSocket Request Enumeration: When a WebSocket client connects to the SignalK stream endpoint with the `serverevents=all` query parameter, the server sends all cached server events including `ACCESS_REQUEST` events that contain details about pending access requests. The `startServerEvents` function iterates over `app.lastServerEvents` and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when `allow_readonly` is true), attackers receive these events containing request IDs, client identifiers, descr