The vulnerability resides in the WebSocket login endpoint of the Signal K Server. Unlike the HTTP login routes, it lacks any rate limiting, allowing an attacker to exhaust the authentication mechanism by sending repeated username and password pairs over a WebSocket connection. The compromised credentials can then be used to gain unauthorized access to the server’s management interfaces, potentially exposing sensitive vessel data and control commands. The weakness is identified as CWE‑307, which deals with insufficient authentication constraints enabling credential stuffing or brute‑force attacks.

Signal K Server applications deployed on vessels with a version older than 2.25.0 are affected. The issue was present in all releases before the 2.25.0 release, which added express‑rate‑limit handling for the WebSocket login route.

The CVSS score of 8.7 reflects the high severity of brute‑force authentication on a critical marine navigation platform. The EPSS score is not available, but because the vulnerability is exploitable without privilege escalation and leverages password hashing at roughly 20 attempts per second, the likelihood of a successful attack is significant in an environment with weak or common credentials. The vulnerability is not included in the CISA KEV catalog, so no public exploitation reports are known. Attackers would typically open a WebSocket connection to the server’s designated port and continuously submit credential attempts, bypassing the 100‑attempt HTTP limit and achieving full enumeration.