Vulnerability Intelligence Report
CVE-2026-56451
A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.
No Active Exploit Signals
CVSS Base Score
10.0
CRITICAL
Exploitability:3.9
Impact Score:6.1
EPSS Probability:0.38%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-347 ↗CWE-347: Improper Verification of Cryptographic Signature
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Siemens | Opcenter X | 0 < V2604 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.384%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Siemens · Vendor · Germany |
| Reserved | 2026-06-22T13:17:54 |
| Published | 2026-07-14T09:19:18 |
| Last Updated | 2026-07-14T14:30:15 |
Community Chatter & Buzz