CVE-2026-41893

Katalog CVE

CVSS 7.5 · High EPSS 0,51%

Kerentanan Improper Restriction of Excessive Authentication Attempts pada signalk signal k server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been patched in version 2.25.0.

Rincian

Terbit di NVD

9 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-307: Improper Restriction of Excessive Authentication Attempts

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/SignalK/signalk-server/security/advisories/GHSA-vmfm-ch9h-5c7g exploit · mitigasi · advisory vendor
• https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d patch
• https://github.com/SignalK/signalk-server/pull/2568 issue tracking · patch
• https://github.com/SignalK/signalk-server/releases/tag/v2.25.0 product · release notes