This vulnerability (CVE-2025-9210) involves improper verification of cryptographic signatures (CWE-347) in the Otalio Ship Property Management System. Specifically, JWTs used for authentication do not have their signatures properly validated in versions prior to 2.22.0. As a result, an authenticated attacker can manipulate JWTs to escalate privileges within the system. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and requires some privileges but no user interaction. The impact affects confidentiality and integrity but not availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

The vulnerability allows authenticated attackers to escalate privileges by tampering with JSON Web Tokens due to missing signature validation. This compromises the confidentiality and integrity of the system, potentially allowing unauthorized access to sensitive functions or data. Availability is not impacted. The high CVSS score reflects the serious nature of the flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users and monitor for suspicious activity related to JWT usage. Avoid relying on JWTs from untrusted sources and consider additional validation layers if possible.