Liman MYS CVE-2026-11348

Exploitation requires network access to the Liman MYS application's authentication/token-handling surface (the JWT-processing endpoint) on a vulnerable build before release.Master.1107; the attacker must construct a token that abuses the improper signature check (per the 'Jwt Attack' tag, e.g. algorithm confusion or a missing/weak signature check). No valid credentials, no privileges (PR:N) and no user interaction (UI:N) are needed per the CVSS vector. Limiting factors: only instances reachable by the attacker are exposed, NVD rates the attack complexity HIGH (AC:H) implying some non-trivial condition such as knowledge of a key, token structure, or a specific misconfiguration may be required, and instances behind network segmentation or with hardened token validation at a proxy are harder to reach.

The NVD CVSS is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): remotely reachable, no privileges or user interaction, but rated high attack complexity. There is tension in the signals: classic JWT signature-verification bypasses (alg confusion, alg:none) are typically LOW complexity once known, so AC:H may overstate the difficulty - independently I assess AC:L, which would push severity higher. There is no EPSS score, no SSVC decision, and no POC in the provided data, and it is not in CISA KEV, so there is currently no evidence of active or automatable exploitation. Net: a genuinely high-severity auth/spoofing flaw by construction, but real-world urgency depends on deployment footprint (niche product) and whether an exploit surfaces; treat as high-priority patch for any Liman MYS operator, monitor for POC.

An attacker who can reach the Liman MYS web interface crafts a forged token (e.g., a JWT with a manipulated algorithm or unsigned/attacker-signed payload) that the server accepts as authentic due to improper signature verification, impersonating a trusted or administrative user. With that forged identity the attacker reads sensitive data and issues management actions. No public exploit is identified at time of analysis, so this reflects the plausible attack path rather than an observed campaign.