CVE-2026-125298
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Nov 10, 2026
Vendor
unknown
Description
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.