CIRCUTOR PowerStudio: JWT alg=none Identity Forgery Across Every Microservice

A fail-open JWT Bearer configuration in CIRCUTOR PowerStudio SCADA WAVE 24.11.6.0's shared authentication library accepts any alg=none JWT with any role claim as a valid identity across every microservice's AdminSecure/UserSecure policy. A custom SignatureValidator always returns a non-null token without validating the signature, combined with RequireSignedTokens=false — an unauthenticated authentication-bypass and identity-forgery primitive that compromises the product's entire authentication trust root and enables the separate shellExecute SYSTEM RCE chain.