High severity · published Aug 18, 2026
CVE-2025-9210
Missing JSON Web Token signature validation in Otalio Ship Property Management System
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Ship Property Management System · Otalio
before 2.22.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9210
github.com
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0023.md
www.otalio.com
https://www.otalio.com/solutions/
More from Ship Property Management System
6.7
CVE-2025-9211
Cross-site scripting in Otalio Ship Property Management System