GHSA-cp4m-m5qx-xxw6CriticalCVSS 9.8
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify...
🔗 CVE IDs covered (1)
📋 Description
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125298
- https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125298.md
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json
- https://www.asiainfo.eu/cloudbss
- https://www.cve.org/CVERecord?id=CVE-2026-125298
- https://github.com/advisories/GHSA-cp4m-m5qx-xxw6