Executive brief
Otalio's Ship Property Management System (SPMS) is a comprehensive platform used by cruise ships to manage guest services, point-of-sale operations, dining, finances, and crew management. An authenticated attacker can forge or modify JSON Web Tokens (JWTs) without signature validation, allowing them to escalate privileges from a low-level user (e.g., POS operator) to an administrator and extend session expiration indefinitely. This could lead to unauthorized access to sensitive ship and guest data, fraudulent transactions, or operational disruption.
Technical details
The vulnerability is a missing cryptographic signature validation on JWT tokens (CWE-347). An authenticated user can intercept and modify JWT claims—such as the "exp" (expiration) claim and "realm_access" (role) claim—using a proxy or browser console, and the application will accept the tampered token without validating the signature. Mandiant demonstrated escalation from a POS user to a super administrator role and extended session validity until the year 5138. Precondition: attacker must possess valid authentication credentials and knowledge of the target roles. The vulnerability affects SPMS versions before 2.22.0 and has been patched in version 2.22.0 and later.
Affected products
- Otalio GMBH Ship Property Management System before 2.22.0
Timeline
- 2025-06-05: disclosed: Issue reported to Otalio
- 2025-06-05: other: Issue confirmed by Otalio
- 2025-12-08: patched: Otalio completes developing patch
- 2026-08-18: advisory: Mandiant advisory and CVE-2025-9210 published