CVE-2026-109758 in Helix Authentication Service
Summary
by MITRE • 10/13/2026
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.
This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution, corrupt application state, and disrupt service availability, including health checks and SCIM or SSO requests. In a later test, this primitive was confirmed to enable remote code execution in a Node.js 24/Express deployment through available gadget chains involving child_process, EJS/Pug, or Passport.
This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
Perforce Helix Authentication Service deployments operating on versions from 2022.1 through 25.2 are susceptible to severe security compromises stemming from the retention of default SCIM bearer tokens within their configuration files. The installation templates for these releases contain a hardcoded default credential that is copied directly into the active configuration by the installer and associated scripts without any mechanism to automatically replace this value with a cryptographically random token. This design flaw results in static authentication credentials being deployed across all instances, creating a predictable attack surface. When the SCIM endpoint is exposed to an attacker or accessible over a network where such default tokens are known, it allows for unauthorized access to the identity management system. An adversary possessing knowledge of this default token can authenticate against the SCIM API and execute user and group operations permitted by the configured provisioning backend, effectively bypassing intended authentication controls. This scenario aligns with CWE-798, which classifies the use of hardcoded credentials as a critical vulnerability leading to unauthorized access.
The risk profile is significantly exacerbated when this default token issue is chained with CVE-2026-61834 within affected releases of the scim-patch dependency. This secondary vulnerability involves a crafted SCIM PATCH request that triggers server-side prototype pollution in Node.js applications. Prototype pollution allows an attacker to modify properties on JavaScript object prototypes, which can corrupt application state and disrupt service availability by interfering with health checks and other critical functions like SCIM or SSO requests. In testing environments utilizing Node version 24 combined with Express frameworks, this primitive has been confirmed to facilitate remote code execution through available gadget chains involving child_process modules, template engines such as EJS or Pug, and authentication libraries like Passport. This chain of exploitation transforms a simple credential issue into a full system compromise, allowing an attacker to execute arbitrary commands on the host server.
The operational impact of these vulnerabilities is profound, encompassing both unauthorized administrative access and complete system takeover depending on the specific version and configuration in use. For organizations running versions prior to 2026.1, the combination of static default tokens and prototype pollution capabilities means that any exposed SCIM endpoint represents a critical entry point for attackers. The ability to perform user and group operations allows adversaries to escalate privileges or create backdoor accounts within the identity provider, while the potential for remote code execution via gadget chains enables direct control over the underlying infrastructure. This dual threat vector undermines the integrity of the authentication service and can lead to broader network compromise if the Helix Authentication Service is integrated with other critical systems relying on accurate user provisioning data.
Mitigation strategies must prioritize immediate remediation by upgrading to version 2026.1 or later, which was released on July 17th, 2026, and includes fixes for both the default token issue and the underlying prototype pollution defect. For environments where an upgrade is not immediately feasible, administrators should manually generate a strong, random SCIM bearer token and replace the hardcoded value in the active configuration files to eliminate the risk of unauthorized access via known defaults. Additionally, network segmentation strategies should be employed to ensure that SCIM endpoints are not directly reachable from untrusted networks or the public internet. Implementing strict input validation on PATCH requests can also help mitigate prototype pollution risks until a full patch is applied. These measures align with ATT&CK techniques related to Initial Access via Valid Accounts and Defense Evasion through Obfuscated Files, emphasizing the need for robust configuration management and network security controls in identity infrastructure.