SignalK signalk-server versions before 2.25.0 implement rate limiting on HTTP login endpoints but do not apply any rate limiting on the WebSocket login mechanism. This allows an attacker to bypass the express-rate-limit protections by sending login attempts over an established WebSocket connection, enabling high-speed brute force password guessing limited only by bcrypt's computational cost (~20 attempts per second with 10 salt rounds). The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) and has a CVSS 4.0 base score of 8.7, indicating high severity. The vulnerability was publicly disclosed on 2026-05-09 and fixed in version 2.25.0 of signalk-server.

An attacker can perform unlimited authentication attempts over WebSocket connections, bypassing HTTP rate limiting controls. This increases the risk of successful brute force attacks against user credentials, potentially leading to unauthorized access to the signalk-server. The vulnerability affects confidentiality and integrity by enabling credential compromise. There are no known exploits in the wild as of the publication date.

Upgrade signalk-server to version 2.25.0 or later, where this vulnerability has been patched by adding appropriate rate limiting to the WebSocket login path. Until the upgrade is applied, consider implementing external rate limiting or monitoring on WebSocket login attempts if feasible. Patch status is confirmed by the vendor's versioning; no other official remediation level is provided.