Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Helix Authentication Service default token allows unauthorized access

CVE-2026-109758 · published 3 days ago
Summary

If a Helix Authentication Service installation still uses the factory default token for its SCIM API, anyone who discovers that token can log in and change user or group settings. This risk applies to versions released between 2022.1 and 2025.2. Update to version 2026.1 or later, or replace the default token with a unique, strong value, and restrict network access to the SCIM endpoint.

What to do
  • Update perforce helix authentication service to version 2026.1.
Affected software
VendorProductAffected versions
perforce helix authentication service <= 2025.2
Fix: upgrade to 2026.1
Original advisory text
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. I...
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.

This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency.

This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
CWE-1321Prototype Pollution
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-109758 · NVD
CVE-2026-109758 · MITRE
Track software like this
Free during beta