CVE-2026-125298

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 incorrectly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to perform privileged actions. Fixed in version 9.2.41.

An attacker could impersonate any user or gain administrative privileges by performing unauthorized operations in the BSS. This poses a serious threat to data confidentiality and integrity.

Update AsiaInfo BSS to version 9.2.41 or later. Until patched, monitor for unusual JWT-bearing requests and consider additional API-side controls.