Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109758

Quick assessment

Affected
Perforce Helix Authentication Service
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perforce Helix Authentication Service (HAS) 部署中，如果保留了随软件发布的默认 SCIM Bearer Token，且攻击者可访问 SCIM 端点，则存在未授权访问漏洞。在 25.2 版本中，安装模板包含一个默认凭据，安装程序会将其复制到活动配置中；但安装程序和配置脚本不会自动将该值替换为随机生成的 Token。攻击者若知晓该默认 Token，即可通过 SCIM API 进行身份验证，并执行由已配置的供应后端所允许的用户和组操作。 此问题可与受影响版本中 scim-pat

CVSS 9.3 · Critical EPSS 0.53% · P43

Affected Version Matrix 1

VendorProduct Version RangeStatus
Perforce Helix Authentication Service 2022.1≤ 2025.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109758

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.  This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution, corrupt application state, and disrupt service availability, including health checks and SCIM or SSO requests. In a later test, this primitive was confirmed to enable remote code execution in a Node.js 24/Express deployment through available gadget chains involving child_process, EJS/Pug, or Passport.  This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Perforce Helix Authentication Service 2022.1 ~ 2025.2 -

II. Public POCs for CVE-2026-109758

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109758

请登录查看更多情报信息。

Other References for CVE-2026-109758 (1)

IV. Related Vulnerabilities

Same vendor: Perforce
Same weakness: CWE-1321

V. Comments for CVE-2026-109758

No comments yet

Leave a comment