Skip to content

CVE-2026-125298 AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

CriticalCVSS 9.3
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.

Affected products

ProductAffected versionsFixed in
AsiaInfo International Business Support System >= 9.2.0, < 9.2.41 9.2.41
AsiaInfo International aether-menu >= 2.2.1, < 2.2.7 2.2.7

References

  • url product
  • url third-party-advisory
  • url vdb-entry
  • url vdb-entry