PT-2026-1024 · Unknown · Signal K Server

Published 2026-01-01 · Updated 2026-01-06 · CVE-2025-68620

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0

Description Signal K Server is a server application used on boats. Versions prior to 2.19.0 contain issues that allow attackers to steal JWT authentication tokens without prior authentication. This is achieved by chaining together WebSocket-based request enumeration and unauthenticated polling of access request status. Unauthenticated WebSocket connections with the serverevents=all query parameter allow attackers to receive ACCESS REQUEST events containing details about pending access requests. The access request status endpoint at /signalk/v1/access/requests/:id returns the full state of an access request, including the JWT token in plaintext, without authentication. Attackers can either create their own access requests and poll for the token after approval, or passively monitor the WebSocket stream for legitimate requests and steal the tokens when approved. The startServerEvents function and the queryRequest function are involved in this process.

Recommendations Versions prior to 2.19.0 should be updated to version 2.19.0 or later.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-68620

GHSA-FQ56-HVG6-WVM5

Affected Products

Signal K Server

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68620.json · Exploit
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-fq56-hvg6-wvm5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68620 · Security Note
• https://osv.dev/vulnerability/GHSA-fq56-hvg6-wvm5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68620 · Vendor Advisory
• https://github.com/SignalK/signalk-server · Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.19.0 · Note
• https://github.com/SignalK/signalk-server/commit/221aff6cd89c56308084d1781b3abbf938605bd3 · Note
• https://twitter.com/CVEnew/status/2006861494328156187 · Twitter Post
• https://twitter.com/CveFindCom/status/2006812483999178780 · Twitter Post
• https://twitter.com/cracbot/status/2008493803930612143 · Twitter Post
• https://twitter.com/TheHackerWire/status/2006817882517418295 · Twitter Post
• https://twitter.com/pulsepatchio/status/2007101475193807062 · Twitter Post
• https://t.me/CVEtracker/41194 · Telegram Post
• https://twitter.com/0dayPublishing/status/2006801545975750881 · Twitter Post