OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint "frontend/api-mdm.php" verifies the signed enrollment-request plist with "openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)". "PKCS7_NOVERIFY" disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the "SERIAL" field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist ("SERIAL" = victim device, attacker-chosen "UDID") with an arbitrary self-signed certificate; POST it unauthenticated to "/api-mdm.php/profile" (Content-Type: "application/pkcs7-signature"); and receive the victim device's freshly minted MDM identity: a certificate with "CN=<serial>" issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned ".mobileconfig" enrollment profile. Additionally, the victim's "mobile_device" database row is silently overwritten with the attacker-supplied "UDID" (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic ("/checkin", "/mdm", "/parameters"), which authenticate callers by the certificate CN (the serial number) via "checkSignature()" in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.