Read the docs
TI-2026-71533 Aliases CVE-2026-109758GHSA-8m68-j7cp-5rcm

Perforce Helix Authentication Service ships a default SCIM token

Priority MEDIUM 48CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Perforce Helix Authentication Service versions 2022.1 through 2025.2 install a default SCIM bearer token that the installer copies into the active configuration without replacing it with a random value (CWE-798). An attacker who knows the default token and can reach the SCIM endpoint can perform user and group operations allowed by the provisioning backend.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00354 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PerforceHelix Authentication Service2022.1 – 2025.2—No fix listedCNA
  • Helix Authentication Service VendorPerforce Affected 2022.1 – 2025.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Perforce Helix Authentication Service. The source description says the defect was removed in version 2026.1, which was released July 17th 2026.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-109758
  2. 2026-10-13 Alias added: GHSA-8m68-j7cp-5rcm
  3. 2026-10-15 1 new reference · CNA
  4. 2026-10-15 CISA SSVC decision points changed

References

Other 1

  • TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
  • TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
  • TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
  • TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
  • TI-2024-02607 SSRF in Akana API Platform CVSS 3.1CRITICAL 9.3
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences