Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-125298 EUVD-2026-123016GHSA-cp4m-m5qx-xxw6

AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

Published Nov 10, 2026 · Assigned by cisa-cg

Vendor: AsiaInfo International Product: aether-menu Product: Business Support System

Description

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.

Affected products

VendorProductAffectedFixed
AsiaInfo International Business Support System 9.2.0 – < 9.2.41 9.2.41
AsiaInfo International aether-menu 2.2.1 – < 2.2.7 2.2.7

Advisories 1

References

  • url product
  • url third-party-advisory
  • url vdb-entry
  • url vdb-entry