Authentication Bypass in Perforce P4 Search

Executive Summary

Perforce P4 Search before version 2026.4.2 has a flaw where it trusts a client-provided address during authentication. This allows an attacker with a stolen P4 Server ticket to bypass host-based restrictions and trusted-address controls, gaining unauthorized access to P4 Search as the ticket's legitimate owner.

Useful 0 Not Useful 0

Impact Analysis

If you use Perforce P4 Search prior to 2026.4.2, an attacker could exploit this to access your P4 Search instance using a stolen ticket. This could lead to unauthorized data access, modification, or exfiltration, depending on the permissions of the compromised account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Perforce P4 Search to version 2026.4.2 or later to address the authentication bypass issue. Review and enforce trusted-address controls and host-based ticket restrictions to prevent unauthorized access.

Useful 0 Not Useful 0