CVE-2025-9210 — Missing JSON Web Token signature validation in Otalio Ship Property Management System

CVE-2025-9210

Missing JSON Web Token signature validation in Otalio Ship Property Management System PUBLISHED

Description (CNA)

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs

Affected (CNA)

Vendor / product	Versions
Otalio / Ship Property Management System	affected 0 before 2.22.0

CWE

CWE-347

References

https://www.otalio.com/solutions/
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0023.md

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.