Key points
- CVE-2026-109758 allows unauthorized access via default SCIM bearer tokens in Perforce Helix Authentication Service.
- The flaw can be chained with CVE-2026-61834 to enable remote code execution through prototype pollution.
- Versions 2022.1 through 2025.2 are affected, while version 2026.1 removes the underlying defect.
A critical security vulnerability in Perforce Helix Authentication Service exposes organizations to remote code execution risks. The flaw, tracked as CVE-2026-109758, stems from default SCIM bearer tokens that remain active in deployments. Attackers can exploit these known credentials to access SCIM endpoints and perform unauthorized user and group operations.
By the numbers
- 9.3: The CVSS score assigned to CVE-2026-109758, indicating a critical severity level for the authentication bypass.
- 2022.1 - 2025.2: The range of Perforce Helix Authentication Service versions vulnerable to the default token exploitation.
- 2026.1: The specific version release that removes the underlying defect, published on July 17th, 2026.
What the figures mean
The high CVSS score reflects the ease with which attackers can gain initial access. According to the NVD record, version 25.2 installation templates include a default credential that the installer copies into active configuration. The installer does not automatically replace this value with a random token. This oversight allows any attacker who knows the default token to authenticate to the SCIM API.
Once authenticated, the attacker can perform operations allowed by the configured provisioning backend. The risk escalates significantly when this flaw is chained with CVE-2026-61834. This secondary vulnerability exists in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution, which corrupts application state.
This corruption can disrupt service availability, including health checks and single sign-on requests. Testing confirmed that this primitive enables remote code execution in Node.js 24/Express deployments. Attackers can leverage available gadget chains involving child_process, EJS/Pug, or Passport to achieve remote code execution. The vulnerability was identified in older versions after version 2026.1 was released, highlighting the importance of timely updates.
What should you do?
Organizations using Perforce Helix Authentication Service must verify their current version immediately. If running version 2025.2 or earlier, the default SCIM token must be rotated or the system updated. Monitoring network traffic for unusual SCIM API activity can help detect exploitation attempts. Ensure that SCIM endpoints are not reachable by untrusted networks to reduce exposure.
What to do and how to stay safe: Perforce
- Verify your Perforce Helix Authentication Service version and update to 2026.1 or later if possible.
- Rotate any default SCIM bearer tokens immediately if you cannot upgrade the software version.
- Restrict network access to SCIM endpoints to prevent unauthorized external authentication attempts.
- Monitor logs for unusual SCIM PATCH requests or prototype pollution indicators in application state.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Perforce Helix are affected by CVE-2026-109758?
Versions 2022.1 through 2025.2 of the Perforce Helix Authentication Service are vulnerable to this flaw.
How can attackers exploit the default SCIM token?
Attackers can use the known default token to authenticate to the SCIM API and perform unauthorized user and group operations.
Is there a fix for this vulnerability?
Yes, version 2026.1 of Perforce Helix Authentication Service removes the underlying defect and was released on July 17th, 2026.
