Unauthorized Access Vulnerability in Perforce Helix Authentication Service
CVE-2026-109758

9.3CRITICAL

Key Information:

Vendor

Perforce

Status
Helix Authentication Service
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109758?

The Perforce Helix Authentication Service (HAS) is vulnerable due to the presence of a default SCIM bearer token in its configuration. This token can be exploited by attackers if the SCIM endpoint is exposed, enabling them to authenticate and perform operations permitted by the provisioning backend. Specifically, HAS installations from versions 2022.1 to 2025.2 could be compromised if the default credential is not replaced during setup, allowing unauthorized user and group manipulations. Moreover, the vulnerability can create chains with other vulnerabilities like those in the scim-patch dependency, leading to possible remote code execution and service disruptions. The issue was addressed in version 2026.1, released on July 17, 2026, which removed the underlying defect.

Affected Version(s)

Helix Authentication Service 2022.1 <= 2025.2

References

https://perforce1.lightning.force.com/lightning/r/CVE__c/...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.