Key points
- CVE-2026-109758 affects Perforce Helix Authentication Service versions 2022.1 through 2025.2.
- Attackers can chain this default credential flaw with prototype pollution to achieve remote code execution.
- Version 2026.1, released July 17, 2026, removes the underlying defect and fixes the issue.
Perforce Helix Authentication Service deployments using default credentials face a critical remote code execution risk. The National Vulnerability Database rates CVE-2026-109758 as CVSS 9.3. This flaw allows unauthorized access when the SCIM endpoint is reachable. Attackers exploit the shipped default SCIM bearer token to authenticate. They can then perform user and group operations allowed by the provisioning backend. This initial access enables further exploitation of the system.
In plain English
The installer for Perforce Helix Authentication Service version 25.2 copies a default credential into the active configuration. The installation templates contain this static value. The configuration script does not automatically replace it with a random token. If an attacker knows this default token, they can log into the SCIM API. This grants them control over user management functions. The flaw exists in versions 2022.1 through 2025.2 of the service.
This issue is dangerous because it can be chained with another vulnerability. CVE-2026-61834 affects the scim-patch dependency in these releases. A crafted SCIM PATCH request causes server-side prototype pollution. This corrupts application state and disrupts service availability. Health checks and single sign-on requests may fail. In testing, this primitive enabled remote code execution. The exploit works on Node.js 24/Express deployments. It uses gadget chains involving child_process, EJS, Pug, or Passport.
The background
The vulnerability was identified in older versions of HAS after version 2026.1 was released. Version 2026.1 was released on July 17, 2026. This update removes the underlying defect that allows the default token misuse. The flaw involves weaknesses CWE-1321 and CWE-798. These relate to improper handling of credentials and use of hard-coded credentials. The installer failure to randomize tokens creates a predictable entry point.
What changes now
Organizations using Perforce Helix Authentication Service must verify their configurations. Those running versions prior to 2026.1 are at risk. The default token must be changed immediately. If the SCIM endpoint is exposed to the internet, the risk is higher. Attackers can exploit these default credentials if they know them. The fix is to upgrade to version 2026.1 or later. This version removes the underlying defect.
Background: Prototype pollution
Prevent prototype pollution by freezing object prototypes and using safe merge utilities that ignore special keys. Avoid direct object assignment for untrusted data. Implement strict schema validation at every boundary where external data enters your application logic.
Read the full guide: Stop Prototype Pollution: Practical Prevention for JavaScript Apps
What to do and how to stay safe: Perforce
- Check if your Perforce Helix Authentication Service is version 2025.2 or older.
- Verify that the SCIM bearer token is not the default value shipped with the installer.
- Restrict network access to the SCIM endpoint to prevent unauthorized external connections.
- Plan an upgrade to version 2026.1 or later once the vendor provides the update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Perforce Helix are affected by this vulnerability?
Versions 2022.1 through 2025.2 of the Authentication Service are affected by CVE-2026-109758.
Can this flaw lead to remote code execution?
Yes, it can be chained with CVE-2026-61834 to enable remote code execution in Node.js 24/Express deployments.
Is there a fixed version available?
Yes, version 2026.1, released July 17, 2026, removes the underlying defect.
