Signal K Server Vulnerable to Access Request Spoofing

Description

The SignalK access request system has two related features that when combined by themselves and with the infromation disclosure vulnerability enable convincing social engineering attacks against administrators.

When a device creates an access request, it specifies three fields: clientId, description, and permissions.

Recommendation

Update the signalk-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.19.0
• Patched version(s): 2.19.0

References

• GHSA-vfrf-vcj7-wvr8
• CVE-2025-69203
• CWE-290
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package - CVE-2025-68619
• Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints - CVE-2025-68273
• Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding - CVE-2025-68272
• Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) - CVE-2025-66398

Tags:

npm

signalk-server