Perforce Helix Authentication Service up to 2025.2 SCIM Endpoint default credentials

Summaryinfo

A vulnerability described as problematic has been identified in Perforce Helix Authentication Service up to 2025.2. This vulnerability affects unknown code of the component SCIM Endpoint. Such manipulation leads to default credentials. This vulnerability is traded as CVE-2026-109758. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Perforce Helix Authentication Service up to 2025.2. It has been rated as problematic. Affected by this issue is an unknown code block of the component SCIM Endpoint. The manipulation with an unknown input leads to a default credentials vulnerability. Using CWE to declare the problem leads to CWE-1392. The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.  This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution, corrupt application state, and disrupt service availability, including health checks and SCIM or SSO requests. In a later test, this primitive was confirmed to enable remote code execution in a Node.js 24/Express deployment through available gadget chains involving child_process, EJS/Pug, or Passport.  This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.

The advisory is shared for download at perforce1.lightning.force.com. This vulnerability is handled as CVE-2026-109758 since 10/13/2026. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are needed for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 2026.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-98279). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Perforce

Name

• Helix Authentication Service

Version

• 2025.0
• 2025.1
• 2025.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion