CVE-2026-58113: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens Teamcenter V2412

Siemens Teamcenter versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607 contain an improper neutralization of input vulnerability (CWE-79) in the /auth/ endpoint. The issue arises from failure to properly encode user-supplied input reflected into HTML attribute contexts during the authentication redirect flow. This allows an unauthenticated remote attacker to inject arbitrary JavaScript code that executes in the context of an authenticated user's browser session, potentially enabling actions within that session.

Successful exploitation allows an unauthenticated attacker to perform cross-site scripting attacks that execute arbitrary JavaScript in the browser of an authenticated Teamcenter user. This can lead to session hijacking or unauthorized actions within the victim's session. The confidentiality and integrity of the user's session could be compromised, but availability is not affected.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Users should monitor Siemens advisories for official fixes addressing this vulnerability. Until a patch is applied, avoid clicking on untrusted URLs that may exploit this flaw.