CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
CriticalCVSS 9.3
EPSS 0.69%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm signalk-server | < 2.33.0 | 2.33.0 |
References
- Patch Commit patch
- github.com product
- GitHub Security Advisory (GHSA-4w32-qx5g-cpwv) vendor-advisory
- github.com technical-description
- signalk-server v2.33.0 Release Notes release-notes
- VulnCheck Advisory: Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs third-party-advisory