Privilege escalation via unchecked JWT signatures

JWT signature validation failure in Ship Property Management System before 2.22.0 lets remote authenticated users raise privileges with tampered JWTs. For higher-privileged sessions, the application accepts an edited Authorization bearer token without verifying its signature and trusts attacker-controlled exp and realm_access claims. An authenticated user who can rewrite that header, such as through a browser console or intercepting proxy, can extend session lifetime and turn a POS account into a super user.