CVE-2025-9210

Published: Aug 18, 2026Modified: Sep 29, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: mandiant-cve@google.com (Secondary)

Description

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs

Related CWEs

CWE-347

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (2)

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0023.md

Source: mandiant-cve@google.com

https://www.otalio.com/solutions/

Source: mandiant-cve@google.com

Timeline

No history available yet.