Signalk Server EUVD-2026-18376

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-accessible attack requiring low complexity but user interaction to trigger. The 6.1 base score reflects low-to-moderate impact (C:L/I:L/A:N - confidentiality and integrity compromise, no availability loss). Real-world risk is elevated because (1) the default-unset redirectUri configuration means most deployments are vulnerable without explicit action, (2) the attack requires only Host header manipulation and user action to visit a phishing link or attacker-controlled page, (3) successful exploitation grants session hijacking and authorization code theft, enabling account takeover. However, this is not a critical RCE or widespread worm vector - it requires social engineering or Man-in-the-Middle positioning to inject the malicious Host header at the network level, or the attacker must trick users into following a specially crafted link. No public exploit code or active exploitation is reported. The vulnerability is most dangerous in IoT/maritime environments where SignalK Server manages boat navigation systems and may integrate with critical control systems.

An attacker identifies that a SignalK Server instance uses OIDC with default (unset) redirectUri configuration. The attacker crafts a phishing email or malicious webpage that, when clicked by the victim, sends an HTTP request to the SignalK login endpoint with a spoofed Host header pointing to the attacker's domain (e.g., 'Host: attacker.com'). The victim's browser initiates the OAuth2 flow, and the OIDC provider - trusting SignalK's redirect_uri directive - sends the authorization code to attacker.com. The attacker captures the code and uses it to establish an authenticated session as the victim, gaining access to the boat's navigation and control systems. No technical exploit code is currently public, but the attack vector is straightforward and requires only standard HTTP manipulation techniques.