EUVD-2025-210738
GHSA-83h2-xpgj-mf4q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable application, low complexity, authenticated user required (PR:L); integrity and confidentiality fully compromised via privilege escalation; no availability impact.
Primary rating from Vendor (Mandiant).
CVSS VectorVendor: Mandiant
Lifecycle Timeline
3DescriptionCVE.org
Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs
AnalysisAI
JWT signature validation is entirely absent in Otalio Ship Property Management System before version 2.22.0, allowing any authenticated user to forge arbitrary token claims and escalate to higher privilege levels. Because the server accepts tampered JWT payloads without verifying the cryptographic signature, a low-privileged account holder can self-promote to administrator or other elevated roles by modifying their own token. Mandiant disclosed this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
JSON Web Tokens (JWTs) are composed of a base64url-encoded header, payload, and cryptographic signature. CWE-347 (Improper Verification of Cryptographic Signature) describes the root cause: the Otalio Ship Property Management System does not validate the HMAC or RSA signature on received tokens, meaning the payload - which typically carries role, permission, or identity claims - can be freely modified by the bearer. This is distinct from algorithm-confusion attacks; the system appears to skip signature verification entirely. The affected CPE is cpe:2.3:a:otalio:ship_property_management_system:*:*:*:*:*:*:*:* for all versions before 2.22.0. The maritime property management domain typically involves vessel records, crew data, financial transactions, and compliance documentation - all of which would be exposed to an attacker with elevated access.
RemediationAI
Upgrade to Otalio Ship Property Management System version 2.22.0 or later, which introduces proper JWT signature validation per the vendor patch. Patch availability is confirmed by vendor per EUVD-2025-210738; the exact fix version (2.22.0) is derived from the affected-version boundary in that record. Consult the Mandiant disclosure at https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0023.md for remediation guidance. As a compensating control prior to patching, operators should audit user account provisioning and reduce the number of active low-privilege accounts, since an attacker requires a valid authenticated session. Additionally, consider deploying an API gateway or WAF capable of inspecting and rejecting structurally anomalous JWTs (e.g., those with a 'none' algorithm header or mismatched claim structures), though this is a partial mitigation and not a substitute for patching. Session invalidation and forced re-login after patching are recommended to clear any forged tokens that may have been issued pre-fix.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today