# CVE-2026-34083: Signal K Server OAuth code theft via unvalidated Host header in OIDC

Source: https://junglewise.ai/threats/cve-2026-34083-signal-k-server-oauth-code-theft-via-unvalidated-host-header-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34083 · Severity: medium · CVSS 6.1 · Published 2026-04-02

Signal K Server is a central data hub used on boats to manage marine navigation and sensor data. A security flaw in its login system allows attackers to manipulate the server into sending sensitive login credentials to a malicious third-party website. If exploited, an attacker could hijack a user's session, gaining unauthorized access to the boat's server and its connected systems.

Technologies: [signalk-server (npm)](https://junglewise.ai/threats/technologies/signalk-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-34083 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34083 being exploited in the wild.

**How severe is CVE-2026-34083?** Medium severity, with a CVSS score of 6.1, published 2 April 2026.

**Which products and versions are affected?** signalk-server (npm) SEMVER:introduced=2.20.0,fixed=2.24.0.

**Is there a fix for CVE-2026-34083?** Yes. signalk-server (npm): upgrade to 2.24.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34083 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34083?** Check whether you run signalk-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- signalk-server (npm): upgrade to 2.24.0 or later

  ```sh
  npm install signalk-server@2.24.0
  ```


## Technical details

Signal K Server (versions 2.20.0 to 2.23.x) contains a vulnerability in its OpenID Connect (OIDC) implementation where the HTTP Host header is used to construct the 'redirect_uri' and 'post_logout_redirect_uri' without validation. Because the 'redirectUri' configuration is optional and lacks a safe default, the server falls back to using the attacker-controlled Host header. An attacker can exploit this by inducing a user to initiate a login with a spoofed Host header, causing the OIDC provider to send the authorization code to an attacker-controlled domain. This allows for session hijacking and open redirection. The risk is exacerbated by official documentation recommending Nginx configurations that forward the Host header. The issue is fixed in version 2.24.0.

## Affected products

- SignalK signalk-server >= 2.20.0, < 2.24.0

## Identifiers

- CVE-2026-34083
- GHSA-cxj8-ggf2-p57c

## Timeline

- 2026-03-26: patched: Version 2.24.0 released
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-34083 published to NVD

## References

- [https://github.com/SignalK/signalk-server/releases/tag/v2.24.0](https://github.com/SignalK/signalk-server/releases/tag/v2.24.0)
- [https://github.com/SignalK/signalk-server/security/advisories/GHSA-cxj8-ggf2-p57c](https://github.com/SignalK/signalk-server/security/advisories/GHSA-cxj8-ggf2-p57c)

## Related threats

- [Signal K Server buffered logs exposure in unauthenticated WebSocket](https://junglewise.ai/threats/signal-k-server-buffered-logs-exposed-to-unauthenticated-websocket-b7032aad)
- [Signal K resources API path traversal and RCE](https://junglewise.ai/threats/signal-k-resources-api-path-traversal-can-disclose-the-jwt-signing-0c6398ee)
- [Signal K Server SSRF in App Store icon fetcher](https://junglewise.ai/threats/cve-2026-115752-signal-k-server-from-2-28-0-beta-2-before-2-34-0-contains-a)
- [Signal K Server SSRF in remote connection endpoints](https://junglewise.ai/threats/cve-2026-55591-signal-k-server-ssrf-in-remote-connection-endpoints)
- [SignalK Signal K Server brute-force protection bypass in WebSocket login](https://junglewise.ai/threats/cve-2026-41893-signalk-signal-k-server-brute-force-protection-bypass-in)