CVE-2025-9210CWE-347

CVE-2025-9210

High · published August 18, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-08-18T23:16Z
References (2)
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0023.md · [email protected]https://www.otalio.com/solutions/ · [email protected]
EPSS history
Timeline
  • 18 AUG 18:25Z
    Missing JSON Web Token signature validation in Otalio Ship Property Management System
    cvelistv5