CVE-2026-41893: Signal K Server WebSocket Login Endpoint Lacks Rate Limiting
Summary
CVE-2026-41893: Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force). Affects signalk-server versions < 2.25.0. Fixed in 2.25.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Signal K Server is an open-source server that facilitates the transmission of maritime data over a network. It is designed to be used in various marine applications, allowing devices to communicate and share information seamlessly. The server includes features such as authentication and data streaming. However, it has a vulnerability in its WebSocket login endpoint, which lacks proper rate limiting, making it susceptible to credential brute-force attacks.
Vulnerability Detail
The vulnerability arises from the WebSocket login path, which allows attackers to bypass the HTTP rate limiting protections present in the server. Specifically, the WebSocket login endpoint directly calls the login function without any throttling or tracking of login attempts. This oversight enables an attacker to send an unlimited number of password guesses at a rate of approximately 20 attempts per second, leveraging the bcrypt hashing algorithm's speed. The implications of this vulnerability are severe, as it allows for rapid credential brute-forcing, potentially compromising user accounts without any restrictions.
How To Fix
Latest published version: 2.34.0 as of 23 Oct 2026
npm install signalk-server@2.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.25.0
This is the first release that contains the fix.
npm install signalk-server@2.25.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a custom rate limiting mechanism for the WebSocket login requests by tracking failed login attempts per remote IP address. This can be done by maintaining a shared store that counts the number of failed attempts and restricts further attempts after a certain threshold is reached.
Conclusion
CVE-2026-41893 represents a significant security risk for users of Signal K Server versions prior to 2.25.0. The lack of rate limiting on the WebSocket login endpoint allows for credential brute-force attacks, which can lead to unauthorized access. It is crucial to update to the patched version or implement workarounds to safeguard against potential exploits.
See every vulnerability recorded for signalk-server →
FAQ
CVE-2026-41893 is a vulnerability in the Signal K Server that allows attackers to perform credential brute-force attacks via the WebSocket login endpoint due to a lack of rate limiting.
If you are using a version of Signal K Server prior to 2.25.0, your server is vulnerable to brute-force attacks, which could lead to unauthorized access to user accounts.
If immediate updates are not possible, implement a custom rate limiting mechanism for the WebSocket login requests to mitigate the risk of brute-force attacks.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including CVE-2026-41893.
The CVSS score for this vulnerability is 8.7, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for signalk-server.
