PT-2026-37162 · Unknown · Signal K Server

Mark Curphey · Published 2026-05-04 · Updated 2026-05-14 · CVE-2026-41893

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.25.0

Description The WebSocket login path, which involves sending {login: {username, password}} messages over an established connection, calls the app.securityStrategy.login() function directly without rate limiting. While the HTTP login endpoints 'POST /login' and 'POST /signalk/v1/auth/login' are protected by express-rate-limit (defaulting to 100 attempts per 10-minute window via HTTP RATE LIMITS), the WebSocket path allows an attacker to bypass these restrictions. This enables unlimited password guessing at the speed allowed by bcrypt, approximately 20 attempts per second. The issue is located in the processLoginRequest function within src/interfaces/ws.ts.

Recommendations Update to version 2.25.0.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-41893

GHSA-VMFM-CH9H-5C7G

Affected Products

Signal K Server

References · 11

• 🔥 https://github.com/SignalK/signalk-server/security/advisories/GHSA-vmfm-ch9h-5c7g · Exploit
• https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d · Patch
• https://github.com/SignalK/signalk-server/pull/2568 · Patch
• https://osv.dev/vulnerability/GHSA-vmfm-ch9h-5c7g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41893 · Security Note
• https://github.com/SignalK/signalk-server · Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.25.0 · Note
• https://t.me/cveNotify/163499 · Telegram Post
• https://t.me/cveNotify/162881 · Telegram Post
• https://t.me/CVEtracker/53229 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053257389449592890 · Twitter Post