AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 contain a vulnerability where cryptographic signatures for JSON Web Tokens (JWT) are not correctly verified. This flaw allows a remote, unauthenticated attacker to forge a valid-looking JWT without a proper signature and perform privileged actions. The issue is fixed in version 9.2.41.