Loading vulnerability…
JWT Authentication Bypass in Siemens Opcenter X
CVE-2026-56451 is an authentication bypass vulnerability affecting Siemens Opcenter X versions before V2604. The application improperly validates the algorithm specified in JSON Web Token (JWT) headers, allowing an unauthenticated remote attacker to forge arbitrary tokens. These tokens can bypass authentication and impersonate any user, including administrators, potentially granting full unauthorized application access. The vulnerability has CVSS v3.1 and v4.0 base scores of 10.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise application confidentiality, integrity, and availability through unauthorized administrative access. An attacker could access sensitive manufacturing operations data and exercise administrative functionality to alter operational records or disrupt application-managed production activities. Effects on connected systems depend on the deployment's integrations and granted permissions.
If you can’t patch tonight, do this now.
Restrict network access to Opcenter X to trusted systems and segments using appropriate access-control mechanisms, such as firewalls and ACLs. Configure the environment according to Siemens' operational guidelines for Industrial Security and the product manuals. Monitor authentication activity for suspicious access. No product-specific workaround is provided; network restrictions reduce exposure but do not correct the vulnerability.
Patch, then assume compromise.
Upgrade Siemens Opcenter X to V2604 or a later version, which fixes the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.