Executive brief
Signal K Server is a central data hub used on boats to manage marine navigation and sensor data. A security flaw in its login system allows attackers to manipulate the server into sending sensitive login credentials to a malicious third-party website. If exploited, an attacker could hijack a user's session, gaining unauthorized access to the boat's server and its connected systems.
Technical details
Signal K Server (versions 2.20.0 to 2.23.x) contains a vulnerability in its OpenID Connect (OIDC) implementation where the HTTP Host header is used to construct the 'redirect_uri' and 'post_logout_redirect_uri' without validation. Because the 'redirectUri' configuration is optional and lacks a safe default, the server falls back to using the attacker-controlled Host header. An attacker can exploit this by inducing a user to initiate a login with a spoofed Host header, causing the OIDC provider to send the authorization code to an attacker-controlled domain. This allows for session hijacking and open redirection. The risk is exacerbated by official documentation recommending Nginx configurations that forward the Host header. The issue is fixed in version 2.24.0.
Affected products
- SignalK signalk-server >= 2.20.0, < 2.24.0
Timeline
- 2026-03-26: patched: Version 2.24.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-34083 published to NVD