CVE-2025-68620: Signal K Server Auth Bypass Vulnerability

CVE-2025-68620 Overview

CVE-2025-68620 is an authentication bypass vulnerability in Signal K Server, a server application that runs on a central hub in boats for marine data integration. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. This vulnerability allows attackers to completely bypass authentication mechanisms by exploiting unauthenticated WebSocket request enumeration combined with unauthenticated polling of access request status endpoints.

Critical Impact

Attackers can steal JWT authentication tokens without any prior authentication, enabling complete authentication bypass and potential full control of the Signal K Server and connected marine systems.

Affected Products

• Signal K Server versions prior to 2.19.0
• Signal K Server 2.19.0-beta1 through 2.19.0-beta4

Discovery Timeline

• 2026-01-01 - CVE CVE-2025-68620 published to NVD
• 2026-01-06 - Last updated in NVD database

Technical Details for CVE-2025-68620

Vulnerability Analysis

This vulnerability represents a classic authentication bypass through the chaining of two distinct security weaknesses. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status, creating a path for complete credential theft.

The first weakness is Unauthenticated WebSocket Request Enumeration. When a WebSocket client connects to the SignalK stream endpoint with the serverevents=all query parameter, the server sends all cached server events including ACCESS_REQUEST events that contain details about pending access requests. The startServerEvents function iterates over app.lastServerEvents and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when allow_readonly is true), attackers receive these events containing request IDs, client identifiers, descriptions, requested permissions, and IP addresses.

The second weakness is Unauthenticated Token Polling. The access request status endpoint at /signalk/v1/access/requests/:id returns the full state of an access request without requiring authentication. When an administrator approves a request, the response includes the issued JWT token in plaintext. The queryRequest function returns the complete request object including the token field, and the REST endpoint uses readonly authentication, allowing unauthenticated access.

Root Cause

The root cause stems from CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The vulnerability exists because the Signal K Server fails to properly authenticate access to sensitive server events via WebSocket connections and access request status endpoints. The startServerEvents function does not verify authorization level before sending cached events to connected clients, and the access request status endpoint improperly uses readonly authentication for an endpoint that can expose JWT tokens.

Attack Vector

An attacker has two paths to exploit these vulnerabilities:

Path 1 - Active Attack: The attacker creates their own access request (potentially using IP spoofing to craft a convincing spoofed request), then polls their own request ID until an administrator approves it, receiving the JWT token in the response.

Path 2 - Passive Attack: The attacker passively monitors the WebSocket stream to discover request IDs from legitimate devices, then polls those IDs and steals the JWT tokens when administrators approve them, effectively hijacking legitimate device credentials.

Both attack paths require zero authentication and enable complete authentication bypass, allowing attackers to gain unauthorized access to the Signal K Server with the permissions of the hijacked token.

Detection Methods for CVE-2025-68620

Indicators of Compromise

• Unusual WebSocket connections to the SignalK stream endpoint with the serverevents=all query parameter from unknown or external IP addresses
• High-frequency polling requests to the /signalk/v1/access/requests/:id endpoint from unauthenticated sources
• Multiple access requests originating from suspicious or spoofed IP addresses
• Authentication tokens being used from IP addresses different from where the access request originated

Detection Strategies

• Monitor WebSocket connections for the serverevents=all parameter usage, particularly from unauthenticated clients
• Implement logging and alerting on repeated access to the /signalk/v1/access/requests/ endpoint from the same source
• Analyze access patterns for polling behavior targeting multiple request IDs in rapid succession
• Correlate token usage with the original access request IP to detect potential token theft

Monitoring Recommendations

• Enable comprehensive logging for all WebSocket connections and access request endpoint interactions
• Set up alerts for access request approvals followed by token usage from different network locations
• Monitor for anomalous spikes in access request polling activity
• Review authentication logs for tokens being used from unexpected geographic locations or network segments

How to Mitigate CVE-2025-68620

Immediate Actions Required

• Upgrade Signal K Server to version 2.19.0 or later immediately
• Review and audit all recently approved access requests for potential unauthorized approvals
• Rotate all existing JWT tokens to invalidate any potentially compromised credentials
• Review access logs for suspicious activity patterns consistent with this vulnerability

Patch Information

Signal K has released version 2.19.0 which fixes the underlying issues. The patch addresses both the unauthenticated WebSocket request enumeration and the unauthenticated token polling vulnerabilities. Users should upgrade to this version immediately.

For detailed information about the patch, see the GitHub Release v2.19.0 and the GitHub Security Advisory GHSA-fq56-hvg6-wvm5.

Workarounds

• If immediate patching is not possible, disable the allow_readonly configuration option to prevent unauthenticated WebSocket connections
• Implement network-level access controls to restrict access to the Signal K Server from trusted networks only
• Use a reverse proxy or firewall to block unauthenticated access to the /signalk/v1/access/requests/ endpoint
• Monitor and manually review all access requests before approval to detect potentially malicious requests