Critical severity9.8NVD Advisory· Published Nov 10, 2026
CVE-2026-125298
CVE-2026-125298
Description
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: 9.2.0 through 9.2.40
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.