CVE-2026-125298: Critical severity AsiaInfo Business Support System (BSS) vulnerability

Q: Which deployments are affected?

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 are affected. The issue is fixed in version 9.2.41.

Q: Does an attacker need credentials or user interaction to exploit this issue?

No. The vulnerability can be exploited remotely by an unauthenticated attacker, and no user interaction is required.

Q: What access could an attacker obtain?

An attacker could forge a well-formed JWT without a valid cryptographic signature and use it to execute privileged actions.

Q: How can I determine whether remediation is needed?

Check the deployed AsiaInfo BSS version. Systems running any version from 9.2.0 through 9.2.40 should be remediated by upgrading to 9.2.41.

Published Nov 10, 2026

Updated

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.

Affected Software

1 affected component

AsiaInfo Business Support System (BSS)>=9.2.0<=9.2.40

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade AsiaInfo Business Support System (BSS) to a version that resolves this vulnerability.
Fixed in 9.2.41

Event History

Nov 10, 2026

CVE Published

via NVD·10:18 PM

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 are affected. The issue is fixed in version 9.2.41.

Does an attacker need credentials or user interaction to exploit this issue?

No. The vulnerability can be exploited remotely by an unauthenticated attacker, and no user interaction is required.

What access could an attacker obtain?

An attacker could forge a well-formed JWT without a valid cryptographic signature and use it to execute privileged actions.

How can I determine whether remediation is needed?

Check the deployed AsiaInfo BSS version. Systems running any version from 9.2.0 through 9.2.40 should be remediated by upgrading to 9.2.41.

CVE-2026-125298: Critical severity AsiaInfo Business Support System (BSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does an attacker need credentials or user interaction to exploit this issue?

What access could an attacker obtain?

How can I determine whether remediation is needed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does an attacker need credentials or user interaction to exploit this issue?

What access could an attacker obtain?

How can I determine whether remediation is needed?