What is the CVSS score of CVE-2026-11348?

CVE-2026-11348 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Liman MYS are affected by CVE-2026-11348?

HAVELSAN Liman MYS contains a JWT signature verification bypass (CVE-2026-11348) enabling unauthenticated remote attackers to forge authentication tokens and impersonate legitimate users.

How to fix or mitigate CVE-2026-11348?

Within 24 hours: Inventory all HAVELSAN Liman MYS deployments (versions before release.Master.1107) and classify by business criticality; contact HAVELSAN support to confirm patch timeline and request interim guidance. Within 7 days: Deploy network-level access controls to restrict Liman MYS to trusted network segments; enable monitoring and alerting on JWT validation failures and failed authentication attempts. Within 30 days: Coordinate vendor patch deployment or implement compensating controls if patch remains unavailable; test in non-production environment first.

Liman MYS CVE-2026-11348

EUVD-2026-42034 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-07 iletisim@usom.gov.tr

GHSA-cmjg-6q27-6fr4

Information Disclosure Jwt Attack

8.1

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network-reachable JWT forgery needs no auth or interaction (AV:N/PR:N/UI:N); typical alg-confusion bypasses are low complexity (AC:L, versus NVD's AC:H); spoofing yields high C/I but no clear direct availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 12:31 vuln.today

DescriptionCVE.org

Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data.

This issue affects Liman MYS: before release.Master.1107.

AnalysisAI

Signature verification bypass in HAVELSAN Liman MYS (versions before release.Master.1107) lets remote attackers forge the source/authenticity of data - tagged as a JWT attack - enabling identity spoofing and likely authentication bypass. Per CVSS the vector is network-based and unauthenticated (AV:N/PR:N) with high impact to confidentiality and integrity. No public exploit is identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

Liman MYS (Management System) is a HAVELSAN-developed centralized Linux/server management panel used to administer hosts and services through a web interface. The root cause is CWE-347, Improper Verification of Cryptographic Signature: the application accepts data whose cryptographic signature is not correctly validated. The 'Jwt Attack' tag strongly implies the weakness lies in JSON Web Token handling - for example accepting the 'alg:none' header, RS256/HS256 algorithm confusion, or otherwise failing to enforce a trusted signing key - which would allow an attacker to mint tokens the server treats as genuine and thereby impersonate a legitimate (potentially administrative) principal.

RemediationAI

Vendor-released patch: upgrade Liman MYS to release.Master.1107 or later, which corrects the signature-verification flaw; this is the primary and recommended remediation. Consult the USOM advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0504 and the HAVELSAN/Liman release notes to confirm the fixed build for your channel. If immediate patching is not possible, compensating controls include restricting network reachability of the Liman MYS web/API interface to trusted management networks or VPN (reduces the AV:N exposure at the cost of remote-admin convenience), rotating and strengthening JWT signing secrets and enforcing an explicit allow-list of signing algorithms at any reverse proxy/WAF if configurable (mitigates alg-confusion/alg:none forgery but may break clients using other algorithms), and invalidating existing sessions/tokens after upgrade. These are stopgaps only - the signature-verification defect itself is fixed solely by the vendor patch.