CVE-2025-68620: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68620 is a critical authentication bypass vulnerability in Signal K Server, a marine data hub application, titled "JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling." It affects all versions prior to 2.19.0, including beta releases up to 2.19.0-beta.4. The vulnerability was published on January 1, 2026, and a patch was released the same day. It carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, SignalK Advisory).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and stems from two chained design flaws. First, the startServerEvents function in src/events.ts broadcasts all cached server events — including sensitive ACCESS_REQUEST events containing request IDs, client identifiers, and IP addresses — to any WebSocket client connecting with the serverevents=all query parameter, without verifying authorization level. Second, the REST endpoint /signalk/v1/access/requests/:id (in src/interfaces/rest.js) uses only readonly authentication, meaning unauthenticated users can poll it freely; when an administrator approves a request, the createReply function in src/requestResponse.js includes the issued JWT token in plaintext in the response. These two flaws can be chained: an attacker discovers a request ID via WebSocket enumeration, then polls the status endpoint until the token appears (Github Advisory, SignalK Advisory).

Successful exploitation allows an unauthenticated attacker to obtain any JWT token issued by the Signal K Server, including fully privileged admin tokens. With an admin token, the attacker gains access to all protected endpoints — including package installation — effectively achieving complete authentication bypass and full server compromise. Attackers can also hijack legitimate device credentials by stealing tokens intended for real devices, enabling impersonation and unauthorized control of vessel systems (Github Advisory, SignalK Advisory).

A public proof-of-concept (PoC) Python script is included directly in the official security advisory, demonstrating WebSocket-based token monitoring and HTTP polling to steal JWT tokens with zero authentication (SignalK Advisory). The vulnerability requires no privileges, no user interaction, and is exploitable over the network, making it trivially weaponizable. The EPSS score is approximately 0.056% (18th percentile) per the GitHub Advisory, though Feedly's EUVD data lists it at 0.16. There is no current evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing Signal K Server instances (default port 3000) using tools like Shodan or Censys, targeting versions prior to 2.19.0.
2. WebSocket Connection: Connect to the Signal K stream endpoint with the serverevents=all parameter: ws://<TARGET_IP>:3000/signalk/v1/stream?serverevents=all. No authentication is required when allow_readonly is enabled.
3. Enumerate Access Requests: Monitor incoming WebSocket messages for events with "type": "ACCESS_REQUEST". Extract the requestId and href fields from the event data, which contain the request identifier and polling URL.
4. Poll the Status Endpoint: Repeatedly send unauthenticated HTTP GET requests to /signalk/v1/access/requests/<requestId> (or the href from the event) every few seconds.
5. Capture the JWT Token: When an administrator approves the request, the polling response transitions to "state": "COMPLETED" and includes the JWT token in plaintext within the accessRequest.token field.
6. Authenticate with Stolen Token: Use the captured JWT token in the Authorization: Bearer <token> header to access all protected Signal K Server endpoints, including admin functions such as plugin installation (SignalK Advisory, Github Advisory).

• Network: Unauthenticated WebSocket connections to /signalk/v1/stream?serverevents=all from unexpected or external IP addresses; repeated unauthenticated HTTP GET requests to /signalk/v1/access/requests/<id> endpoints from the same source IP.
• Logs: Signal K Server access logs showing frequent polling of /signalk/v1/access/requests/ paths without authentication headers; WebSocket connections with serverevents=all parameter from IPs not associated with known vessel devices.
• Behavioral: Unexpected use of admin-level JWT tokens from IP addresses that did not originate the corresponding access request; access request approvals followed immediately by privileged API calls (e.g., package installation) from unfamiliar clients.

Upgrade Signal K Server to version 2.19.0 or later immediately, as this release restricts ACCESS_REQUEST events to authenticated admin users only and introduces a new serverAdminEvent channel for sensitive data (SignalK Release, Patch Commit). Note that beta versions 2.19.0-beta1 through 2.19.0-beta4 are also affected and should not be used as secure alternatives. If immediate patching is not possible, implement network-level access controls to restrict Signal K Server access to trusted networks only, and rotate any JWT tokens previously issued by affected instances (Github Advisory).

The vulnerability was reported by security researcher atsc11 and published by Signal K maintainer tkurki on January 1, 2026, with an urgent note in the v2.19.0 release that internet-facing servers should update immediately (SignalK Release). The vulnerability was covered by The Hacker Wire and noted in CISA's weekly vulnerability bulletin for the week of December 29, 2025. The inclusion of a working PoC in the advisory drew attention to the ease of exploitation given the zero-authentication requirement.