Unauthenticated Token Exposure in Signal K Server by Signal K

CVE-2025-68620

What is CVE-2025-68620?

The Signal K Server, a server application for boat systems, prior to version 2.19.0, contains vulnerabilities that allow attackers to steal JWT authentication tokens without any authentication. This is achieved through a combination of unauthenticated WebSocket request enumeration and token polling. By exploiting the WebSocket connection, attackers can receive sensitive event information including request IDs and user identifiers. An unauthenticated request for the access status can return a plaintext JWT token when an access request is approved by an administrator. Attackers can exploit this through either creating spoofed access requests or by passively monitoring legitimate requests, leading to potential credential hijacking.

References