CVE-2026-55591

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the `/skServer/ziplogs` endpoint. Attackers can extract the JWT `secretKey` from `security.json` in the ZIP, forge administrator tokens, and create persistent admin accounts. This is fixed in version 2.33.0.

Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.

Signal K Server before version 2.19.0 contains two vulnerabilities that can be chained to steal JWT tokens without any authentication. The first is unauthenticated WebSocket request enumeration via the serverevents=all parameter, and the second is unauthenticated polling of access request status, which returns the JWT token in plaintext after an administrator approves the request.

Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains an SSRF vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, with image responses stored and served via the admin UI.

Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.

Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.

Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.

Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.

Signal K Server before version 2.19.0 has a vulnerability in the access request system that combines two related issues: improper display of the `permissions` field (less visible than the description) and unconditional trust in the `X-Forwarded-For` header for determining the client's IP address. An attacker can exploit these flaws to craft a convincing social engineering attack against an administrator, impersonating a trusted device and requesting elevated permissions.