CVE-2025-69203

Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicious requests appear to originate from trusted internal network addresses. Since device/source names can be enumerated via the information disclosure vulnerability, an attacker can impersonate a legitimate device or source, craft a convincing description, spoof a trusted internal IP address, and request elevated permissions, creating a highly convincing social engineering scenario that increases the likelihood of administrator approval. Users should upgrade to version 2.19.0 to fix this issue.

• CWE-290

• https://github.com/SignalK/signalk-server/releases/tag/v2.19.0Release Notes
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-vfrf-vcj7-wvr8Exploit, Vendor Advisory

Published

Jan 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69198Pterodactyl is a free, open-source game server management pa…6.5
• CVE-2025-69199Wings is the server control plane for Pterodactyl, a free, o…6.5
• CVE-2025-6920A flaw was found in the authentication enforcement mechanism…5.3
• CVE-2025-69200phpMyFAQ is an open source FAQ web application. In versions …7.5
• CVE-2025-69201Tugtainer is a self-hosted app for automating updates of doc…9.8
• CVE-2025-69202Axios Cache Interceptor is a cache interceptor for axios. Pr…6.5
• CVE-2025-69204ImageMagick is free and open-source software used for editin…7.5
• CVE-2025-69205Micro Registration Utility (µURU) is a telephone self regist…6.3
• CVE-2025-69206Hemmelig is a messing app with with client-side encryption a…4.3
• CVE-2025-69207Khoj is a self-hostable artificial intelligence app. Prior t…7.1
• CVE-2025-69208free5GC UDR is the user data repository (UDR) for free5GC, a…5.3
• CVE-2025-69209ArduinoCore-avr contains the source code and configuration f…6.9