Critical JWT Forgery Flaw in Siemens Opcenter X Enables Full Account Takeover

Siemens disclosed CVE-2026-56451, a critical authentication-bypass vulnerability in Opcenter X caused by improper validation of the algorithm specified in a JSON Web Token (JWT) header. The flaw affects all versions earlier than V2604 and allows an unauthenticated remote attacker to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application.

The issue is classified as CWE-347 and was assigned a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with reporting indicating a maximum severity score of 10.0 under both CVSS 3.1 and 4.0. Siemens identified V2604 as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.