CVE-2026-10714

The record

A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens. This could allow an authenticated low-privilege user to impersonate any authorized user on the FTSP server, resulting in unauthorized access to system configuration and the ability to grant permissions to other systems protected by FTSP.

Affected packages

Related vulnerabilities

• CVE-2026-115967 Weak Authentication vulnerability in Hamid Alinia Login with phone number… CWE-1390
• CVE-2025-30414 Local privilege escalation due to improper authentication. CWE-1390
• CVE-2026-85939 Weak authentication in Windows Kernel allows an authorized attacker to bypass a security… CWE-1390
• CVE-2026-83840 Weak authentication in Windows Error Reporting allows an authorized attacker to elevate… CWE-1390
• CVE-2026-83674 Weak authentication in Active Directory Federation Services (AD FS) allows an… CWE-1390
• CVE-2026-83657 Weak authentication in Windows Modern Device Management (MDM) allows an authorized… CWE-1390
• CVE-2026-83586 Weak authentication in Windows Resilient File System (ReFS) Deduplication Service allows… CWE-1390
• CVE-2026-83511 Weak authentication in Active Directory Federation Services (AD FS) allows an… CWE-1390