CVE-2026-109758: Critical severity Perforce Helix Authentication Service vulnerability
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend.
This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution, corrupt application state, and disrupt service availability, including health checks and SCIM or SSO requests. In a later test, this primitive was confirmed to enable remote code execution in a Node.js 24/Express deployment through available gadget chains involving childprocess, EJS/Pug, or Passport.
This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perforce Helix Authentication Service (HAS)to a version that resolves this vulnerability.Fixed in 2026.1 - Configuration
Replace the shipped default SCIM bearer token with a random token in the active configuration.
Perforce Helix Authentication Service (HAS) SCIM bearer token = random token
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated attackers?
Deployments are exposed when they run HAS versions 2022.1 through 2025.2, retain the shipped default SCIM bearer token, and have a SCIM endpoint reachable by an attacker. The installation templates include the default credential, and the installer and configuration script do not automatically replace it.
What access does knowledge of the default token provide?
An attacker who knows the token can authenticate to the SCIM API. They can perform the user and group operations permitted by the configured provisioning backend.
What is the impact if this is combined with the scim-patch issue?
A crafted SCIM PATCH request can trigger server-side prototype pollution, corrupt application state, and disrupt health checks, SCIM requests, or SSO requests. Testing also confirmed remote code execution in a Node.js 24/Express deployment with available gadget chains involving child_process, EJS/Pug, or Passport.
How can an organization determine whether it still needs remediation?
Check whether the HAS deployment is version 2022.1 through 2025.2 and whether its active SCIM configuration still contains the shipped default bearer token. The underlying defect was removed in version 2026.1.