Lucene search
K

5 matches found

Github Security Blog
Github Security Blog
added 2026/01/02 3:28 p.m.4 views

Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

SignalK Server exposes two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. Unauthenticated WebSocket Request Enumeration: When ...

9.1CVSS6.9AI score0.00056EPSS
Exploits1References5Affected Software1
OSV
OSV
added 2026/01/01 6:29 p.m.1 views

CVE-2025-68620 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated...

9.1CVSS7.1AI score0.00056EPSS
Exploits1References4
CVE
CVE
added 2026/01/01 6:29 p.m.9 views

CVE-2025-68620

CVE-2025-68620 concerns Signal K Server (v2.19.0 prior) where two flaws enable JWT token theft without authentication. First, Unauthenticated WebSocket Request Enumeration: connecting to the stream endpoint with serverevents=all exposes cached ACCESS_REQUEST events to readonly/unauthenticated use...

9.1CVSS6.8AI score0.00056EPSS
Exploits1References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/01/01 6:29 p.m.1 views

CVE-2025-68620 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated...

9.1CVSS6.8AI score0.00056EPSS
Exploits1References2
Cvelist
Cvelist
added 2026/01/01 6:29 p.m.20 views

CVE-2025-68620 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 expose two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated...

9.1CVSS0.00056EPSS
Exploits1References2
Rows per page
Query Builder