CVE-2025-68620 | SignalK Server up to 2.18.x REST Endpoint requests startServerEvents authentication bypass (GHSA-fq56-hvg6-wvm5)

A vulnerability categorized as critical has been discovered in SignalK Server up to 2.18.x. The impacted element is the function startServerEvents of the file /signalk/v1/access/requests/ of the component REST Endpoint. Such manipulation leads to authentication bypass using alternate channel.

This vulnerability is listed as CVE-2025-68620. The attack may be performed from remote. There is no available exploit.

It is advisable to upgrade the affected component.