Description

A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-08T09:18:16.450Z",
  "pubdate": "2026-09-08T09:18:16.450Z",
  "executiveSummary": "A Reflected Cross-Site Scripting (XSS) vulnerability exists within the authentication redirect flow of Teamcenter versions V2412, V2506, V2512, and V2606. The vulnerability arises due to improper sanitization of user-supplied input that is reflected directly into HTML attribute contexts within the /auth/ endpoint.\nThis security flaw allows an unauthenticated remote attacker to execute arbitrary JavaScript within the security context of a victim's authenticated Teamcenter session. By enticing an authenticated user to access a maliciously crafted URL, an attacker can bypass traditional security controls to perform unauthorized actions on behalf of the victim. The impact includes session hijacking, unauthorized data exfiltration, and potential manipulation of sensitive enterprise workflows managed within the Teamcenter environment.\nThe risk is critical, as it requires no prior authentication to initiate the attack, though exploitation is dependent on user interaction. Organizations utilizing the affected versions must prioritize applying the specified security updates to remediate the vulnerable code path.",
  "technicalDetails": "The vulnerability is a classic Reflected XSS flaw located in the /auth/ endpoint of the Teamcenter application suite. The root cause is the failure of the application to properly encode or escape untrusted user-supplied input before rendering it inside HTML attributes during the authentication redirection process. When the application receives a request with specifically crafted parameters intended for the redirect flow, it dynamically injects these parameters into the rendered HTML page without validating the content against a whitelist or applying context-aware output encoding.\nThe attack flow begins when an attacker crafts a malicious URL containing a JavaScript payload injected into the vulnerable URL parameters. The attacker must then persuade an authenticated user to click this link, typically via social engineering or embedded content. When the victim browser navigates to the crafted /auth/ endpoint, the server processes the request and reflects the unsanitized input directly into the HTML attribute context. Because the browser interprets the injected content as active code rather than passive data, the payload executes within the security origin of the Teamcenter application.\nSince the script executes in the context of the user's active session, it possesses the ability to access the document object model (DOM), extract session tokens, and make unauthorized API calls to Teamcenter backend services using the victim's credentials. The attacker can effectively impersonate the user to perform read or write operations, modify resource configurations, or exfiltrate sensitive engineering data. This vulnerability affects Teamcenter V2412 (all versions prior to V2412.0013), V2506 (all versions prior to V2506.0010), V2512 (all versions prior to V2512.2607), and V2606 (all versions prior to V2606.2607).\nThe lack of proper input validation at the entry point of the authentication module represents a significant security oversight. By failing to normalize input prior to reflection, the application inadvertently creates an execution vector for arbitrary scripts. Because this endpoint is reachable without authentication, it broadens the attack surface to any remote actor capable of reaching the web interface, significantly increasing the probability of successful exploitation if the application is internet-facing or accessible to unauthorized network segments."
}