PT-2026-144821

CVE-2026-125298

Published

2026-11-10

Updated

2026-11-10

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40

Description An issue exists where the system fails to correctly verify cryptographic signatures for JSON Web Tokens (JWT), which are compact, URL-safe means of representing claims to be transferred between two parties. A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature to execute privileged actions.

Recommendations Update AsiaInfo Business Support System (BSS) to version 9.2.41.

Exploitability

Exploit

Fix

Impacts

Researchers

Trevor Kaon

Vendors

Affected products

Weakness enumeration

CWE-347: Improper Verification of Cryptographic Signature

Related identifiers