Vulnerability in AsiaInfo Business Support System Leads to Forged Action Executions
CVE-2026-125298

9.3CRITICAL

Key Information:

Vendor

Asiainfo International

Status
Business Support System
Aether-menu
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125298?

The AsiaInfo Business Support System (BSS) from versions 9.2.0 to 9.2.40 suffers from a vulnerability due to inadequate verification of cryptographic signatures for JSON Web Tokens (JWT). This flaw allows a remote, unauthenticated attacker to create forged JWTs that appear well-formed but lack valid signatures. With this forged token, attackers can perform privileged actions within the system, potentially compromising sensitive data and functionalities. The issue has been addressed in version 9.2.41.

Affected Version(s)

aether-menu 2.2.1 < 2.2.7

Business Support System 9.2.0 < 9.2.41

aether-menu 2.2.7

References

https://www.asiainfo.eu/cloudbss
product
https://github.com/trevorkaon/vulnerability-security-rese...
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-125298
vdb-entry

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trevor Kaon, security researcher (ORCID 0009-0007-0562-1331)
.