CVE-2026-34083

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirect_uri. Because the redirectUri configuration is silently unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions in realistic deployments as The OIDC provider will then send the authorization code to whatever domain was injected. This issue has been patched in version 2.24.0.

• CWE-346
• CWE-601

• https://github.com/SignalK/signalk-server/releases/tag/v2.24.0Product, Release Notes
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-cxj8-ggf2-p57cExploit, Vendor Advisory
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-cxj8-ggf2-p57cExploit, Vendor Advisory

Published

Apr 2, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34077React Router is a router for React. In versions 7.7.0 throug…7.5
• CVE-2026-34078Flatpak is a Linux application sandboxing and distribution f…10
• CVE-2026-34079Flatpak is a Linux application sandboxing and distribution f…7.5
• CVE-2026-3408A vulnerability was identified in Open Babel up to 3.1.1. Th…6.5
• CVE-2026-34080xdg-dbus-proxy is a filtering proxy for D-Bus connections. P…5.5
• CVE-2026-34082Dify is an open-source LLM app development platform. Prior t…4.3
• CVE-2026-34084PhpSpreadsheet is a library for reading and writing spreadsh…9.8
• CVE-2026-34085fontconfig before 2.17.1 has an off-by-one error in allocati…7.8
• CVE-2026-34086Vulnerability in Wikimedia Foundation AbuseFilter. This iss…2.1
• CVE-2026-34087Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2026-34088Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2026-34089Vulnerability in Wikimedia Foundation Scribunto. This issue…7.5