CVE-2026-125298
Last modified
CVE-2026-125298 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions.
Description
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| AsiaInfo International | Business Support System | >= 9.2.0, < 9.2.41 |
| AsiaInfo International | aether-menu | >= 2.2.1, < 2.2.7 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-125298?
How severe is CVE-2026-125298?
How do I fix CVE-2026-125298?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-12527A broken authorization boundary in the RTSP media delivery p…6
- CVE-2026-125270FFmpeg through 9.0.2 contains a heap out-of-bounds read vuln…5.3
- CVE-2026-125271Incorrect normalization of operation names in the custom sec…7.8
- CVE-2026-12528A flaw was found in 389 Directory Server in the __aclp__norm…5.4
- CVE-2026-12529A security vulnerability has been detected in SourceCodester…7.3
- CVE-2026-125297AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 …9.8
- CVE-2026-1253The Group Chat & Video Chat by AtomChat plugin for WordPress…4.3
- CVE-2026-12530Improper neutralization of argument delimiters in the instal…7.3
- CVE-2026-125320pgEdge Postgres MCP Server enables SQL queries against Postg…5.3
- CVE-2026-125321pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
- CVE-2026-125322pgEdge Postgres MCP Server enables SQL queries against Postg…6.5
- CVE-2026-125323pgEdge Control Plane is a distributed application for managi…7.8
Are you affected by CVE-2026-125298?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST