CVE-2026-109758

Awaiting Analysis Awaiting Analysis - Queue

Default SCIM Bearer Token Authentication Bypass in Perforce Helix

Publication date: 2026-10-13

Last updated on: 2026-10-15

Assigner: Perforce

Description

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109758

EUVD

EUVD-2026-98279

Affected Vendors & Products

Vendor	Product	Version / Range
Perforce	Helix	Authentication Service 2022.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

Perforce Helix Authentication Service (HAS) versions 2022.1 to 2025.2 have a default SCIM bearer token that attackers can use to gain unauthorized access if the SCIM endpoint is exposed. This token allows manipulation of user and group data via the SCIM API. The issue can be combined with another vulnerability (CVE-2026-61834) to cause server-side prototype pollution, potentially leading to remote code execution in Node.js deployments.

Detection Guidance

Check if the default SCIM bearer token is still active by inspecting HAS configuration files for the presence of the default credential. Verify if the SCIM endpoint is exposed to external networks by reviewing network access controls and firewall rules.

Impact Analysis

An attacker exploiting this could gain unauthorized access to user and group management functions, modify configurations, or disrupt services. In severe cases, it may lead to remote code execution, allowing full control over the affected system. This could result in data breaches, service outages, or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face fines, legal penalties, or reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Upgrade to HAS version 2026.1 or later, which removes the vulnerability. If upgrading is not immediately possible, replace the default SCIM bearer token with a strong, randomly generated one and restrict SCIM endpoint access to trusted internal networks only.

Hi! I’m here to help you understand CVE-2026-109758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70