CVE-2025-68620
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Signal K Server before version 2.19.0 contains two vulnerabilities that can be chained to steal JWT tokens without any authentication. The first is unauthenticated WebSocket request enumeration via the serverevents=all parameter, and the second is unauthenticated polling of access request status, which returns the JWT token in plaintext after an administrator approves the request.
Risk Assessment
An attacker can completely bypass authentication by stealing JWT tokens of legitimate devices or by creating their own request and waiting for approval. This leads to full control over the Signal K system on the boat, including access to data and control functions.
Recommendation
Immediately upgrade Signal K Server to version 2.19.0 or later, which fixes these issues. Additionally, consider disabling the allow_readonly option if not required, and restrict access to the server ports.
Other vulnerabilities in Signal K Server
See all- CVE-2026-118690Critical
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the `/skServer/ziplogs` endpoint. Attackers can extract the JWT `secretKey` from `security.json` in the ZIP, forge administrator tokens, and create persistent admin accounts. This is fixed in version 2.33.0.
- CVE-2026-33950Critical
Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.
- CVE-2025-66398Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.
- CVE-2026-115752Medium
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains an SSRF vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, with image responses stored and served via the admin UI.
- CVE-2026-55591Medium
Signal K Server prior to 2.28.0 has a vulnerability in makeRemoteRequest() that accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination. When security is not configured, the endpoints testSignalKConnection, requestAccess, and checkAccessRequest are accessible without authentication, allowing port scanning, exfiltration of cloud metadata and internal service data, and lateral movement.
- CVE-2026-41893High
Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.
- CVE-2026-35038Medium
Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.
- CVE-2026-34083Medium
Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.
- CVE-2026-33951High
Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.
- CVE-2025-69203Medium
Signal K Server before version 2.19.0 has a vulnerability in the access request system that combines two related issues: improper display of the `permissions` field (less visible than the description) and unconditional trust in the `X-Forwarded-For` header for determining the client's IP address. An attacker can exploit these flaws to craft a convincing social engineering attack against an administrator, impersonating a trusted device and requesting elevated permissions.
Original NVD description (English source)
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. The first is Unauthenticated WebSocket Request Enumeration: When a WebSocket client connects to the SignalK stream endpoint with the `serverevents=all` query parameter, the server sends all cached server events including `ACCESS_REQUEST` events that contain details about pending access requests. The `startServerEvents` function iterates over `app.lastServerEvents` and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when `allow_readonly` is true), attackers receive these events containing request IDs, client identifiers, descriptions, requested permissions, and IP addresses. The second is Unauthenticated Token Polling: The access request status endpoint at `/signalk/v1/access/requests/:id` returns the full state of an access request without requiring authentication. When an administrator approves a request, the response includes the issued JWT token in plaintext. The `queryRequest` function returns the complete request object including the token field, and the REST endpoint uses readonly authentication, allowing unauthenticated access. An attacker has two paths to exploit these vulnerabilities. Either the attacker creates their own access request (using the IP spoofing vulnerability to craft a convincing spoofed request), then polls their own request ID until an administrator approves it, receiving the JWT token; or the attacker passively monitors the WebSocket stream to discover request IDs from legitimate devices, then polls those IDs and steals the JWT tokens when administrators approve them, hijacking legitimate device credentials. Both paths require zero authentication and enable complete authentication bypass. Version 2.19.0 fixes the underlying issues.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS