CVE-2026-34083 Details
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirect_uri. Because the redirectUri configuration is silently unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions in realistic deployments as The OIDC provider will then send the authorization code to whatever domain was injected. This issue has been patched in version 2.24.0.
A vulnerability in Signal K Server's OpenID Connect (OIDC) login and logout handlers allows for OAuth2 authorization code theft and session hijacking. This issue arises from the use of an unvalidated HTTP Host header to construct the redirect_uri, a critical component in the OIDC flow. The vulnerability affects Signal K Server versions 2.20.0 prior to 2.24.0. By default, the redirectUri configuration is unset, enabling an attacker to spoof the Host header and redirect authorization codes to a malicious domain. This exploitation is facilitated by the server's official documentation, which advises forwarding the Host header through Nginx, thereby amplifying the risk in real-world deployments.
Users can upgrade to Signal K Server version 2.24.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SignalK/signalk-server/security/advisories/GHSA-cxj8-ggf2-p57c | CISA-ADP | ExploitVendor Advisory |
| https://github.com/SignalK/signalk-server/releases/tag/v2.24.0 | [email protected] | ProductRelease Notes |
| https://github.com/SignalK/signalk-server/security/advisories/GHSA-cxj8-ggf2-p57c | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| signalk signal k server | < 2.24.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | New CVE Received | [email protected] |