Read the docs
TI-2026-01191 Aliases CVE-2026-1496GHSA-gc4h-xc67-2w55

Coverity CLI Authentication Bypass

Priority MEDIUM 49CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Fixed Coverity (Black Duck): 2025.12.0, 2024.3.0A, 2024.3.1A +19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Black DuckCoverity2024.3.0 to before 2025.12.02025.12.0, 2024.3.0A, 2024.3.1A, 2024.3.2A, 2024.6.0A, 2024.6.1A, 2024.9.0A, 2024.9.1A, 2024.12.0A, 2024.12.1A, 2024.12.2, 2025.3.0A, 2025.3.1A, 2025.3.2, 2025.6.0A, 2025.6.2A, 2025.6.4, 2025.9.0A, 2025.9.2A, 2025.9.3, 2025.12.0A, 2025.12.1Patch availableCNA
  • Coverity VendorBlack Duck Affected 2024.3.0 to before 2025.12.0 Fixed in 2025.12.0, 2024.3.0A, 2024.3.1A, 2024.3.2A, 2024.6.0A, 2024.6.1A, 2024.9.0A, 2024.9.1A, 2024.12.0A, 2024.12.1A, 2024.12.2, 2025.3.0A, 2025.3.1A, 2025.3.2, 2025.6.0A, 2025.6.2A, 2025.6.4, 2025.9.0A, 2025.9.2A, 2025.9.3, 2025.12.0A, 2025.12.1 Patch available CNA

Remediation

  • Fix · CNA Coverity (Black Duck) Fixed in 2025.12.0, 2024.3.0A, 2024.3.1A, 2024.3.2A, 2024.6.0A, 2024.6.1A, 2024.9.0A, 2024.9.1A, 2024.12.0A, 2024.12.1A, 2024.12.2, 2025.3.0A, 2025.3.1A, 2025.3.2, 2025.6.0A, 2025.6.2A, 2025.6.4, 2025.9.0A, 2025.9.2A, 2025.9.3, 2025.12.0A, 2025.12.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1496
  2. 2026-10-03 Alias added: GHSA-gc4h-xc67-2w55

References

Advisory 3

Other 1

  • TI-2026-07338 Authentication and Authorization Bypass in Coverity Connect CVSS 4.0CRITICAL 9.2
  • TI-2026-07339 SQL Injection in Coverity Connect SOAP API CVSS 4.0HIGH 8.7
  • TI-2024-11153 Stored cross-site scripting in Black Duck Coverity CVSS 4.0HIGH 8.5
  • TI-2026-53243 OS command injection in blackduck-c-cpp CVSS 4.0HIGH 7.5
  • TI-2026-53242 Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp… CVSS 4.0HIGH 7.1
  • TI-2025-00418 Black Duck SCA Project Privilege Escalation CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences