CVE-2026-56451

Name of the Vulnerable Software and Affected Versions Opcenter X versions prior to V2604

Description An issue exists where the application does not properly validate the algorithm specified in the JSON Web Token (JWT) header during token verification. This flaw, known as JWT algorithm confusion, allows an unauthenticated remote attacker to forge arbitrary tokens by manipulating the alg value in the header. By presenting these forged tokens to endpoints that trust JWT-based authentication, an attacker can bypass authentication mechanisms and impersonate any user, including administrative accounts, potentially gaining full unauthorized access to the application and its data.

Recommendations Upgrade to version V2604.