CVE-2026-34083

Katalog CVE

CVSS 6.1 · Medium EPSS 0,14%

Kerentanan Origin Validation Error pada signalk signal k server. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirect_uri. Because the redirectUri configuration is silently unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions in realistic deployments as The OIDC provider will then send the authorization code to whatever domain was injected. This issue has been patched in version 2.24.0.

Rincian

Terbit di NVD

2 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/SignalK/signalk-server/security/advisories/GHSA-cxj8-ggf2-p57c exploit · advisory vendor
• https://github.com/SignalK/signalk-server/releases/tag/v2.24.0 product · release notes