VYPR
Get started
← All advisories
Moderate severityOSV Advisory· Published Jan 1, 2026· Updated Jan 2, 2026

Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

CVE-2025-68273

Description

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
signalk-servernpm
< 2.19.02.19.0

Affected products

1

Patches

1
ead2a03d8994

Merge commit from fork

https://github.com/SignalK/signalk-serverTeppo KurkiDec 27, 2025via ghsa
commit
1 file changed · +4 −1
  • src/tokensecurity.js+4 −1 modified
    @@ -251,6 +251,8 @@ module.exports = function (app, config) {
       '/providers',
       '/settings',
       '/webapps',
+      '/availablePaths',
+      '/hasAnalyzer',
       '/skServer/inputTest'
     ].forEach((p) =>
       app.use(`${SERVERROUTESPREFIX}${p}`, http_authorize(false))
@@ -271,7 +273,8 @@ module.exports = function (app, config) {
       '/backup',
       '/restore',
       '/providers',
-      '/vessel'
+      '/vessel',
+      '/serialports'
     ].forEach((p) =>
       app.use(`${SERVERROUTESPREFIX}${p}`, adminAuthenticationMiddleware(false))
     )

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.