CVE-2026-41893 Details
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been patched in version 2.25.0.
A vulnerability in Signal K Server prior to version 2.25.0 allows for credential brute-forcing via the WebSocket login endpoint. While the HTTP login routes are protected by rate limiting, the WebSocket endpoint lacks similar safeguards, enabling attackers to send unlimited password guesses at a rate of approximately 20 attempts per second, constrained only by bcrypt's hashing process. This issue has been addressed in version 2.25.0.
Users can update to Signal K Server version 2.25.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SignalK/signalk-server/security/advisories/GHSA-vmfm-ch9h-5c7g | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d | [email protected] | Patch |
| https://github.com/SignalK/signalk-server/pull/2568 | [email protected] | Issue TrackingPatch |
| https://github.com/SignalK/signalk-server/releases/tag/v2.25.0 | [email protected] | ProductRelease Notes |
| https://github.com/SignalK/signalk-server/security/advisories/GHSA-vmfm-ch9h-5c7g | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| signalk signal k server | < 2.25.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | New CVE Received | [email protected] |