CVE-2026-109758
Received Received - Intake

Default SCIM Bearer Token Authentication Bypass in Perforce Helix

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Perforce

Description
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.  This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution, corrupt application state, and disrupt service availability, including health checks and SCIM or SSO requests. In a later test, this primitive was confirmed to enable remote code execution in a Node.js 24/Express deployment through available gadget chains involving child_process, EJS/Pug, or Passport.  This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109758
EUVD
EUVD-2026-98279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Perforce Helix Authentication Service 2022.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Perforce Helix Authentication Service (HAS) versions 2022.1 to 2025.2 have a default SCIM bearer token that attackers can use to gain unauthorized access if the SCIM endpoint is exposed. This token allows manipulation of user and group data via the SCIM API. The issue can be combined with another vulnerability (CVE-2026-61834) to cause server-side prototype pollution, potentially leading to remote code execution in Node.js deployments.

Detection Guidance

Check if the default SCIM bearer token is still active by inspecting HAS configuration files for the presence of the default credential. Verify if the SCIM endpoint is exposed to external networks by reviewing network access controls and firewall rules.

Impact Analysis

An attacker exploiting this could gain unauthorized access to user and group management functions, modify configurations, or disrupt services. In severe cases, it may lead to remote code execution, allowing full control over the affected system. This could result in data breaches, service outages, or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face fines, legal penalties, or reputational damage due to non-compliance with these regulations.

Mitigation Strategies

Upgrade to HAS version 2026.1 or later, which removes the vulnerability. If upgrading is not immediately possible, replace the default SCIM bearer token with a strong, randomly generated one and restrict SCIM endpoint access to trusted internal networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109758. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart