Is CVE-2026-34083 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34083 being exploited in the wild.

How severe is CVE-2026-34083?

Medium severity, with a CVSS score of 6.1, published 2 April 2026.

Which products and versions are affected?

signalk-server (npm) SEMVER:introduced=2.20.0,fixed=2.24.0.

Is there a fix for CVE-2026-34083?

Yes. signalk-server (npm): upgrade to 2.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34083 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34083?

Check whether you run signalk-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34083: Signal K Server OAuth code theft via unvalidated Host header in OIDC

CVE-2026-34083 · Severity: medium · CVSS 6.1 · Published 2026-04-02

Signal K Server is a central data hub used on boats to manage marine navigation and sensor data. A security flaw in its login system allows attackers to manipulate the server into sending sensitive login credentials to a malicious third-party website. If exploited, an attacker could hijack a user's session, gaining unauthorized access to the boat's server and its connected systems.

Technologies: signalk-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-34083 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34083 being exploited in the wild.
How severe is CVE-2026-34083?: Medium severity, with a CVSS score of 6.1, published 2 April 2026.
Which products and versions are affected?: signalk-server (npm) SEMVER:introduced=2.20.0,fixed=2.24.0.
Is there a fix for CVE-2026-34083?: Yes. signalk-server (npm): upgrade to 2.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34083 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34083?: Check whether you run signalk-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

signalk-server (npm): upgrade to 2.24.0 or later
```
npm install signalk-server@2.24.0
```

Technical details

Signal K Server (versions 2.20.0 to 2.23.x) contains a vulnerability in its OpenID Connect (OIDC) implementation where the HTTP Host header is used to construct the 'redirect_uri' and 'post_logout_redirect_uri' without validation. Because the 'redirectUri' configuration is optional and lacks a safe default, the server falls back to using the attacker-controlled Host header. An attacker can exploit this by inducing a user to initiate a login with a spoofed Host header, causing the OIDC provider to send the authorization code to an attacker-controlled domain. This allows for session hijacking and open redirection. The risk is exacerbated by official documentation recommending Nginx configurations that forward the Host header. The issue is fixed in version 2.24.0.

Affected products

SignalK signalk-server >= 2.20.0, < 2.24.0

Identifiers

CVE-2026-34083
GHSA-cxj8-ggf2-p57c

Timeline

2026-03-26: patched: Version 2.24.0 released
2026-04-01: advisory: GitHub Security Advisory published
2026-04-02: disclosed: CVE-2026-34083 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.