CVE-2026-118690

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.33.0

Description An authentication bypass allows unauthenticated remote attackers to download log archives through the '/skServer/ziplogs' endpoint. By accessing the ZIP archive, attackers can retrieve the secretKey from the security.json file. This allows them to forge JSON Web Tokens (JWT)—a standard for securely transmitting information between parties as a JSON object—to create persistent administrator accounts and gain full control of the server.

Recommendations Update Signal K Server to version 2.33.0 or later. Restrict access to the '/skServer/ziplogs' endpoint to minimize the risk of exploitation.