Signal K Server versions prior to 2.33.0 have a missing authentication flaw that lets attackers call the /skServer/ziplogs endpoint without credentials. The resulting ZIP archive contains the security.json file with the JWT secretKey, which an attacker can use to forge administrator tokens and create persistent admin accounts, granting them full control of the server. This weakness aligns with CWE-306.

All releases of Signal K Server before version 2.33.0 are vulnerable, regardless of minor patch level. Administrators running the server should verify that they are using a version 2.33.0 or newer to avoid this issue.

The flaw carries a CVSS score of 9.3, indicating a critical severity. Because the vulnerable endpoint is exposed over the network and requires no prior authentication, remote attackers can exploit it by sending a crafted HTTP request to /skServer/ziplogs. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and lack of access restrictions mean that exploitation is likely if the server is reachable from the internet.