Loading story…
Siemens disclosed CVE-2026-56451, a critical authentication-bypass vulnerability in Opcenter X caused by improper validation of the algorithm specified in a JSON Web Token (JWT) header. The flaw affects all versions earlier than V2604 and allows an unauthenticated remote attacker to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application.
The issue is classified as CWE-347 and was assigned a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with reporting indicating a maximum severity score of 10.0 under both CVSS 3.1 and 4.0. Siemens identified V2604 as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Siemens provided Opcenter X V2604 as the remediation for CVE-2026-56451. The disclosure also stated that no active exploitation had been reported at the time of release.
Siemens disclosed a critical JWT algorithm confusion vulnerability in Opcenter X, tracked as CVE-2026-56451. The flaw affects all versions earlier than V2604 and could let an unauthenticated remote attacker forge JWTs, bypass authentication, and impersonate users including administrators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcethreataft.com
Open sourcecert-portal.siemens.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in **Postiz** allows any authenticated user to escalate privileges to **SUPERADMIN** by forging JWTs through the application's **Skool integration callback**. Tracked as **`CVE-2026-48781`** and **`GHSA-j77w-h625-56q2`**, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's `JWT_SECRET`, while authentication logic trusted the token's claims without reloading the user record from the database. The bug affects Postiz versions prior to **`2.21.8`** and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated **CVSS 9.9 (Critical)**, was verified and patched by the vendor, and defenders are advised to upgrade to **`2.21.8`**, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
Jul 12, 2026
A critical vulnerability tracked as **CVE-2026-56271** allows remote attackers to bypass authentication in **Flowise** by forging valid JWTs and impersonating arbitrary users, including administrators. The flaw affects versions before **3.1.0**, including **3.0.13** and earlier, and stems from weak hardcoded default JWT secrets plus default audience and issuer values in the enterprise passport authentication middleware. When the relevant JWT environment variables are not explicitly configured, Flowise falls back to publicly known defaults, effectively embedding insecure default credentials into the authentication path. The issue is rated **CVSS v3.1 9.8** and **CVSS v4.0 9.3** as remotely exploitable, and remediation guidance calls for upgrading to **Flowise 3.1.0 or later** and setting strong, unique JWT secrets along with custom audience and issuer values.
Jul 18, 2026
A **maximum-severity authentication bypass** was disclosed in *pac4j*’s JWT component (*pac4j-jwt*), tracked as **CVE-2026-29000**, affecting a widely used Java security engine embedded across many downstream software packages. The issue is a **logic flaw** that enables attackers to bypass authentication controls by crafting tokens/claims in a way that defeats expected verification, raising concern because exploitation can be relatively straightforward and the library’s transitive use complicates exposure tracking and patch rollout across dependent applications. Public **proof-of-concept (PoC)** code is available, and reporting indicates an attacker who can obtain a target server’s **RSA public key** (often publicly accessible) can forge a **JWE-wrapped PlainJWT** containing arbitrary `sub` and role claims to bypass signature verification and authenticate as any user, including administrators. The pac4j maintainer disclosed the defect and released patched versions shortly after private reporting; while there were no confirmed in-the-wild exploits at the time of reporting, defenders should expect downstream vendors and application owners to issue their own advisories and updates as they assess inherited risk from bundled pac4j versions.
Jun 29, 2026