Executive brief
Siemens Opcenter X, a manufacturing operations management solution, contains a critical security flaw in how it verifies user identity tokens. An attacker can exploit this to create fake credentials and log into the system as any user, including administrators, without needing a password. This could lead to a total compromise of the application, allowing unauthorized access to sensitive production data and operational controls.
Technical details
A vulnerability exists in Siemens Opcenter X due to improper verification of cryptographic signatures (CWE-347) within JSON Web Token (JWT) headers. The application fails to strictly validate the 'alg' header, which allows a remote, unauthenticated attacker to forge arbitrary JWTs. By manipulating the token header (e.g., using the 'none' algorithm or switching from asymmetric to symmetric verification), an attacker can impersonate any user account, including those with administrative privileges. This results in a complete authentication bypass and full unauthorized access to the application. The issue is resolved in version V2604.
Affected products
- Siemens Opcenter X All versions < V2604
Timeline
- 2026-07-14: advisory: Siemens published SSA-096828
- 2026-07-14: patched: Update to V2604 released