[carlospolop]

Blog URL

https://bishopfox.com/blog/xss-siemens-teamcenters-login-redirect-cve-2026-58113

Blog Title

Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)

Blog high summary

CVE-2026-58113 is reflected XSS in Teamcenter Active Workspace’s /auth/ SSO redirect. Unencoded query names and values break the generated form action, inject onformdata, and execute when onLoad calls form.submit(). A logged-in victim only needs to open a crafted link; no attacker account is required. CVSS 4.0: 8.5. (bishopfox.com)

Same-origin JavaScript reads the JavaScript-accessible XSRF-TOKEN, uses credentials: 'include' and keepalive, and POSTs setSurrogate, potentially granting an attacker-controlled eligible account the victim’s workflow authority. Fixed builds are V2412.0013, V2506.0010, V2512.2607, and V2606.2607 or later; audit /auth/ and surrogate logs. (bishopfox.com)

PR changes

• src/pentesting-web/xss-cross-site-scripting/README.md: Added a concise formdata event distinction for auto-submitting forms, browser caveat, source citations, and links to related CSRF and account-takeover pages.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The base XSS chapter covers attribute breakout and event handlers, but not the formdata trigger during automatic submission. The distinction between formdata and submit events is supported by MDN. A redundant encoding reminder was removed.

Head: 3ec3d4bcb5f1fa8c9a860ad913a20183e2c9047d

[carlospolop]

merge