CVE-2025-9210
Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.15%
- CWE
- CWE-347
- Published
- 2026-08-18
- Last modified
- 2026-08-18
Affected products
- Otalio Ship Property Management System
Weakness type
Related vulnerabilities
- CVE-2026-48558 — SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
- CVE-2026-33746 — Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users
- CVE-2026-31946 — OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow
- CVE-2026-33026 — nginx-ui Backup Restore Allows Tampering with Encrypted Backups
- CVE-2026-4478 — Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification
- CVE-2026-34377 — Zebra has a Consensus Failure due to Improper Verification of V5 Transactions
- CVE-2026-56451 — A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate
- CVE-2026-54782 — CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation