CVE-2026-41893: Signalk Securitystrategy Login Without Rate Limit
Call to securityStrategy.login() is not preceded by a login rate-limit check in the enclosing function. Authentication entry points must be throttled to prevent online brute-force / credential-stuffing attacks (CVE-2026-41893, CWE-307). The HTTP routes /login and /signalk/v1/auth/login are guarded by express-rate-limit, but WebSocket message handlers invokin
TSgreprules fetch cve-2026-41893-signalk-securitystrategy-login-without-rate-limit --engine opengrepDescription
Call to securityStrategy.login() is not preceded by a login rate-limit check in the enclosing function. Authentication entry points must be throttled to prevent online brute-force / credential-stuffing attacks (CVE-2026-41893, CWE-307). The HTTP routes /login and /signalk/v1/auth/login are guarded by express-rate-limit, but WebSocket message handlers invokin
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.