The vulnerability arises when the server builds the OAuth2 redirect_uri from an unvalidated HTTP Host header during the OIDC login and logout handlers. Because the redirectUri configuration is left empty by default, an attacker can forge the Host header so that the OAuth provider sends the authorization code to a domain controlled by the attacker. This allows the attacker to obtain a valid OAuth code and hijack a victim’s session, impersonating them without credentials. The flaw is rooted in CWE‑346 (Untrusted Content for Authentication) and CWE‑601 (Open Redirect) weaknesses where untrusted input is used to control critical authentication flow parameters.

Any instance of Signal K Server running a version earlier than v2.24.0 is affected. The product is the central hub software used on boats, and the vulnerable code resides in its OIDC login and logout handlers. Users who have not applied the 2.24.0 release or otherwise configured a fixed redirect_uri remain susceptible.

The CVSS base score of 6.1 indicates a moderate severity. The vulnerability has not been observed in the CISA KEV catalog, and EPSS data is unavailable. Exploitation requires only the ability to send a crafted HTTP request to the server’s OIDC endpoints, targeting the Host header. No local privileges or additional services are needed, making the attack condition straightforward for an adversary with network access to the server. The attack vector is inferred to be remote over the network.