Unauthenticated Token Exposure in Signal K Server by Signal K

CVE-2025-68620

What is CVE-2025-68620?

The Signal K Server, a server application for boat systems, prior to version 2.19.0, contains vulnerabilities that allow attackers to steal JWT authentication tokens without any authentication. This is achieved through a combination of unauthenticated WebSocket request enumeration and token polling. By exploiting the WebSocket connection, attackers can receive sensitive event information including request IDs and user identifiers. An unauthenticated request for the access status can return a plaintext JWT token when an access request is approved by an administrator. Attackers can exploit this through either creating spoofed access requests or by passively monitoring legitimate requests, leading to potential credential hijacking.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References