Executive brief
Signal K Server, a central hub used for marine data on boats, contains a security flaw in its login system. While standard web logins were protected against repeated password guessing, an alternative login method via WebSockets was not. This allows an attacker to attempt thousands of passwords in a short period to gain unauthorized access to the vessel's server.
Technical details
Signal K Server prior to version 2.25.0 implements rate limiting for HTTP login endpoints (POST /login) using express-rate-limit, but fails to apply similar protections to the WebSocket login path. An attacker can establish a WebSocket connection and send '{login: {username, password}}' messages to call the internal login strategy directly. Because this path bypasses the HTTP middleware, it allows for unthrottled brute-force attempts at the speed of the underlying bcrypt hash verification (approximately 20 attempts per second). The vulnerability is addressed in version 2.25.0 by introducing a shared LoginRateLimiter that tracks attempts across both HTTP and WebSocket protocols.
Affected products
- SignalK Signal K Server < 2.25.0
Timeline
- 2026-04-05: other: Vulnerability reported via GHSA-vmfm-ch9h-5c7g
- 2026-04-07: patched: Fix committed to master branch
- 2026-04-19: advisory: Version 2.25.0 released with fix
- 2026-05-09: disclosed: CVE-2026-41893 published