CVE-2026-41893
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.
Risk Assessment
An attacker can perform a brute-force attack on user passwords without any rate limiting, significantly increasing the risk of account compromise.
Recommendation
Immediately update Signal K Server to version 2.25.0 or later, which includes a fix for rate limiting WebSocket login.
Other vulnerabilities in Signal K Server
See all- CVE-2025-68619High
Signal K Server prior to version 2.19.0 allows administrators to install npm packages via a REST API endpoint. The version parameter accepts arbitrary npm version specifiers including URLs, enabling arbitrary code execution via postinstall scripts. Version 2.19.0 contains a patch.
- CVE-2025-68272High
Signal K Server prior to version 2.19.0 has a DoS vulnerability that allows an unauthenticated attacker to flood the /signalk/v1/access/requests endpoint, causing a 'JavaScript heap out of memory' error and crashing the server. Version 2.19.0 fixes the issue.
- CVE-2026-33950Critical
Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.
- CVE-2025-68620Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to chain two features to steal JWT tokens: unauthenticated WebSocket request enumeration and unauthenticated polling of access request status.
- CVE-2025-66398Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.
- CVE-2026-35038Medium
Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.
- CVE-2026-34083Medium
Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.
- CVE-2026-33951High
Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.
Original NVD description (English source)
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been patched in version 2.25.0.