CVE-2025-68620: Signal K Server JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
Summary
CVE-2025-68620: Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling. Affects signalk-server versions < 2.19.0. Fixed in 2.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Signal K Server is an open-source server that provides a platform for marine data communication and management. It allows users to access and share real-time data from various marine devices. The server is designed to facilitate communication between devices and applications, enabling users to monitor and control marine environments effectively. However, it has been found to have a critical vulnerability that exposes JWT tokens, potentially allowing unauthorized access to sensitive functionalities.
Vulnerability Detail
The vulnerability arises from two main features of Signal K Server: unauthenticated WebSocket request enumeration and unauthenticated polling of access request status. When a WebSocket client connects with the 'serverevents=all' parameter, it receives all cached server events, including sensitive access request details without any authorization checks. Additionally, the access request status endpoint allows unauthenticated users to retrieve the full state of access requests, including JWT tokens in plaintext when approved. This combination enables attackers to steal JWT tokens, leading to complete authentication bypass and unauthorized access to protected endpoints.
How To Fix
Minimum fixed version
2.19.0
This is the first release that contains the fix.
npm install signalk-server@2.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, disable the 'allow_readonly' setting in the server configuration to prevent unauthenticated users from accessing WebSocket events. Additionally, ensure that sensitive endpoints are protected with strict authentication.
Conclusion
The vulnerability CVE-2025-68620 in Signal K Server poses a significant risk by allowing unauthorized access to JWT tokens. It is crucial to update to the patched version 2.19.0 or later to mitigate this risk. Additionally, implementing temporary workarounds can help protect against potential exploitation until the update is applied.
See every vulnerability recorded for signalk-server →
FAQ
CVE-2025-68620 is a critical vulnerability in Signal K Server that allows attackers to steal JWT tokens through unauthenticated WebSocket enumeration and polling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An attacker can obtain JWT tokens without authentication, allowing them to hijack legitimate user sessions and gain unauthorized access to sensitive functionalities.
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
If you cannot update immediately, disable the 'allow_readonly' setting and ensure that sensitive endpoints require strict authentication as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for signalk-server.
