Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE

A vulnerability exists in the Teamcenter login-redirect flow, specifically within the handling of request parameters reflected into an HTML form without proper contextual encoding. This flaw, tracked as CVE-2026-58113, allows for a reflected Cross-Site Scripting (XSS) vulnerability that can execute code with zero user interaction beyond opening a crafted link. The mechanism exploits the automatic submission behavior of the redirect page, which triggers an event handler upon loading. This chain allows an attacker to inject arbitrary data into HTML attributes, use this context to inject and execute JavaScript, and ultimately achieve silent account delegation within the Teamcenter system.
The vulnerability is amplified because the reflected input lands in a context where it can break out of the form's action attribute, injecting new attributes like onformdata, which fires upon programmatic submission. This permits execution within the authenticated session, leading to the potential for state-changing actions such as granting a user surrogate rights over another's permissions, impacting critical engineering workflows.
Defenders must prioritize patching the system to fixed builds and then implement broader security measures focused on auditing surrogate delegations. The root cause lies in failing to apply context-aware output encoding, necessitating stricter input validation and defense-in-depth strategies like Content Security Policy.

* Siemens Teamcenter is a product lifecycle management platform used for engineering designs, bills of materials, and approval workflows.
* CVE-2026-58113 is a reflected Cross-Site Scripting (XSS) flaw in the Teamcenter /auth/ login-redirect flow.
* The flaw occurs because the page reflects attacker-controlled query input into an auto-submitting HTML form without encoding it.
* Opening a crafted link is the only user action required for exploitation.
* The mechanism involves injecting an attribute like onformdata via reflection, which executes code when the form automatically submits upon page load.
* The reflection occurs in the /auth/ endpoint by reflecting request parameters into HTML element attributes unencoded.
* Exploitation involved breaking out of the form action attribute to inject new attributes using encoded quote characters and attribute names.
* Execution was achieved via the formdata event firing during programmatic submission, resulting in zero-interaction code execution.
* The successful exploit demonstrated an ability to call a Teamcenter API endpoint to set a surrogate relationship between user accounts.
* Siemens rated the vulnerability 8.5 (High) under CVSS 4.0.
* Affected branches include V2412, all versions < V2412.0013; V2506, all versions < V2506.0010; and V2606, all versions < V2606.2607.

The core dynamic observed is the transformation of a low-severity reflected XSS vulnerability into a high-impact privilege escalation vector by exploiting specific application behaviors—specifically, programmatic form submission within an SSO redirect context. The danger is not merely the XSS itself, but the specific interaction between attribute reflection and auto-submission mechanics that nullifies typical mitigation steps like user interaction requirements for script execution. This reveals a critical gap where perceived medium risk (XSS) does not align with actual consequence when chained into highly privileged system functions, such as surrogate delegation in an engineering PLM environment.
The process of weaponization shifts the focus from simple data exfiltration to systemic control: leveraging the authenticated session and automated trust mechanisms (like double-submit CSRF tokens) to force a state change across user boundaries. This suggests that security analysis must move beyond assessing individual vulnerability severity scores to evaluating the potential impact of chained exploitation paths against high-value system functions. The failure resides in context-aware output encoding failing to account for the specific execution environment created by application flow design.
The implication is that developers must adopt a posture where every data reflection into HTML, especially within authentication flows, is treated as an active mechanism capable of orchestrating system state, not just presenting information. This demands a paradigm shift from treating reflected input as mere text to viewing it as executable instructions operating within a session boundary. The missing piece in defense is anticipating these complex, automated execution chains across application boundaries, rather than relying solely on standard XSS detection signatures or simple CSRF protection assumptions.
Bridge Questions: How should security architects design authentication and redirection flows to inherently prevent attribute injection from leading to programmatic execution regardless of the form's submission behavior? What modeling techniques are necessary to accurately score vulnerabilities based on potential systemic privilege escalation within enterprise systems like PLM? What is the responsibility allocation when an automated process, designed for usability, becomes the vector for high-impact security breaches?