Perforce Helix HAS Default Token Flaw Enables Remote Code Execution

Perforce Helix Authentication Service contains a critical vulnerability that allows attackers to gain unauthorized access and potentially execute remote code. The issue stems from default credentials that remain in active configurations unless manually changed by administrators during installation.

The flaw, tracked as CVE-2026-109758, carries a CVSS score of 9.3 and is rated critical. It affects deployments where the shipped default SCIM bearer token is retained. If an attacker can reach the SCIM endpoint, they can use this known token to authenticate and perform user and group operations.

Context and Background

The vulnerability exists because installation templates in version 25.2 include a default credential. The installer copies this value into the active configuration without automatically replacing it with a random token. This design choice leaves systems exposed if administrators do not manually rotate the token after setup.

An attacker possessing the default token can authenticate to the SCIM API. They can then execute operations allowed by the configured provisioning backend. This includes managing users and groups, which can facilitate further lateral movement or privilege escalation within the target environment.

Who Is Affected

This vulnerability impacts Perforce Helix Authentication Service versions 2022.1 through 2025.2. The underlying defect was removed in version 2026.1, which was released on July 17, 2026. Although the fix was released for newer versions, the vulnerability was identified in older versions after that release date.

The issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution. This corrupts application state and disrupts service availability, including health checks and single sign-on requests.

In testing, this primitive was confirmed to enable remote code execution in Node.js 24/Express deployments. Attackers can exploit available gadget chains involving child_process, EJS/Pug, or Passport modules to achieve this outcome. This combination of flaws significantly increases the severity of the exposure for affected systems.

What should you do?

Organizations using Perforce Helix Authentication Service should verify their current version immediately. If running versions 2022.1 through 2025.2, users should review their configuration for the default SCIM bearer token. Changing this token is essential to prevent unauthorized access to the SCIM API.

Administrators should also monitor for unusual activity on SCIM endpoints. Signs of prototype pollution or unexpected server behavior may indicate exploitation attempts. Once the vendor provides an update, applying it promptly will mitigate these risks.