CVE-2026-56451
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Opcenter X (versions prior to V2604) stems from improper validation of the algorithm in the JWT header. An unauthenticated remote attacker can forge arbitrary JWT tokens, bypass authentication, and impersonate any user, including administrative accounts.
Risk Assessment
The risk for the organization includes full compromise of the Opcenter X application by an unauthorized attacker, potentially leading to data theft, manipulation of industrial processes, and business disruption.
Recommendation
Immediately upgrade Opcenter X to version V2604 or later, which includes a fix for JWT algorithm validation. Until the update is applied, restrict network access to the application and implement additional multi-factor authentication mechanisms.
Original NVD description (English source)
A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to the application.