The vulnerability arises from the OCO‑Server Apple MDM enrollment endpoint frontend/api‑mdm.php/profile using the OpenSSL function openssl_pkcs7_verify with the PKCS7_NOVERIFY flag. That flag disables certificate chain and trust validation, allowing a self‑signed PKCS#7 signature to be accepted as long as the signature is cryptographically self‑consistent. An attacker can therefore forge a signed plist that contains a victim device’s serial number and an attacker‑chosen UDID, submit it unauthenticated to the endpoint, and obtain the victim’s freshly minted MDM identity: a certificate issued by the server’s internal MDM device CA together with its private key in a PKCS#12 payload. The endpoint also silently overwrites the victim’s database row with the attacker‑supplied UDID, enabling device‑record hijack. With the stolen certificate and key the attacker can impersonate the device on all subsequent MDM traffic, reading management data, replacing push tokens, disrupting or redirecting enrollment, and gaining full control of the device’s MDM relationship.

The affected product is the schorschii OCO‑Server, versions prior to 1.2.3. No other vendors or products are listed as impacted.

The CVSS score of 9.1 indicates high severity. EPSS is not available, so the exploitation probability cannot be quantified, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is network‑based: an adversary with network access to the server can craft and POST a forged PKCS#7 blob to /frontend/api-mdm.php/profile. Since the endpoint does not require prior authentication, the attacker only needs knowledge of a victim's device serial number to succeed. Once the server issues the MDM identity, the attacker obtains the device’s private key, which is sufficient to hijack the device’s MDM session and perform all actions authenticated by that certificate.