CVE-2026-109758

Executive Summary

Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 are deployed with a shipped default SCIM bearer token that the installer copies directly into the active configuration rather than replacing it with a randomized value. When the SCIM endpoint is network-reachable, any attacker who knows this default credential can authenticate to the SCIM API and perform unauthorized user and group operations permitted by the configured provisioning backend. The flaw can be chained with CVE-2026-61834 (a server-side prototype pollution in the scim-patch dependency) to corrupt application state, disrupt availability, and, under specific deployment conditions, achieve remote code execution.

Technical Analysis

The vulnerability is a hard-coded credential weakness (CWE-798). The root cause resides in the HAS installation workflow: the installation templates in version 25.2 contain a default SCIM bearer token, and both the installer and the configuration script copy that value verbatim into the active runtime configuration. Neither component generates or substitutes a random token. As a result, every deployment that has not manually rotated the token shares the same predictable authentication secret.

The attack surface is the SCIM provisioning API exposed by HAS. SCIM (System for Cross-domain Identity Management) endpoints are bearer-token authenticated, meaning possession of the token is sufficient to authenticate — there is no secondary factor or challenge. An attacker who supplies the default token in the authorization header gains the same API privileges as a legitimate provisioning client. Because the impact is bounded by the configured provisioning backend, the exposed operations map to user and group management: creating, reading, modifying, and deleting users and groups depending on backend policy.

Two additional factors amplify the risk. First, the defect is not remediated by the affected release train at all: per the NVD description, the underlying defect was only removed in version 2026.1 (released July 17, 2026), and the issue was identified in older versions after that fixed release shipped — meaning the affected code remains live on 2022.1 through 2025.2 deployments indefinitely unless administrators upgrade. Second, the SCIM API is a high-value pivot point. It issues and manages identity objects, so compromise of the provisioning channel is effectively compromise of the identity source of truth for downstream services that trust HAS.

A critical chained primitive exists: CVE-2026-61834, affecting the scim-patch dependency in affected releases. A crafted SCIM PATCH request triggers server-side prototype pollution, corrupting application state and disrupting service availability, including health checks and SCIM or SSO requests. The default-token flaw provides the authentication foothold required to deliver that PATCH request. In testing described in the source data, the prototype-pollution primitive was confirmed to enable remote code execution in a Node.js 24/Express deployment via available gadget chains involving child_process, EJS/Pug, or Passport. The RCE confirmation is deployment-specific (Node.js 24/Express with those gadget chains present) and should not be assumed universal, but it demonstrates that the chained impact ceiling is full host compromise.

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-109758, and the CVE has not yet been scored by FIRST.org (EPSS) nor added to CISA KEV.

Exploitation Scenarios

No public PoC is available; the following chain is inferred strictly from the vulnerability class (hard-coded credential) and the described chaining behavior.

1. Reconnaissance / target identification. An attacker identifies internet- or intranet-reachable Perforce HAS deployments, for example via fingerprinting of SCIM provisioning endpoints or HAS login/administration interfaces. Because the credential is shipped by default and not rotated, no brute force or credential theft is required — only reachability of the SCIM endpoint.

2. Authentication with the default token. The attacker supplies the published default SCIM bearer token in the API authorization header. HAS accepts it because the installer and configuration script never replaced the template value with a random token. This is the core trigger for CWE-798: authentication succeeds using a shared, predictable secret.

3. Execution at the vulnerability-class level. With an authenticated SCIM session, the attacker performs user and group operations permitted by the configured provisioning backend. To escalate, the attacker issues a crafted SCIM PATCH request that exploits CVE-2026-61834 in the scim-patch dependency, inducing server-side prototype pollution. The exact PATCH payload structure is not disclosed in the provided data and is not fabricated here. In a confirmed Node.js 24/Express test environment, this pollution primitive was leveraged through gadget chains involving child_process, EJS/Pug, or Passport to achieve remote code execution.

4. Post-exploitation impact. Immediate effects include unauthorized identity manipulation (creation, modification, or deletion of users and groups), corrupted application state, and service disruption covering health checks and SCIM/SSO requests. Where the prototype-pollution-to-RCE chain succeeds, the attacker gains code execution on the HAS host, enabling further lateral movement against the identity infrastructure and any downstream systems that trust HAS-issued identities.

Impact Assessment

The primary impact is unauthorized access to an identity management API, giving an unauthenticated remote attacker (once the default token is known) the ability to manipulate users and groups. This directly degrades confidentiality and integrity of identity data, corresponding to the C:L/I:L components in the representative vector. Availability impact is initially none from the token flaw alone, but the chained CVE-2026-61834 prototype pollution explicitly disrupts health checks and SCIM or SSO request handling, and in confirmed configurations escalates to full remote code execution.

Blast radius: any HAS deployment in the 2022.1–2025.2 range that (a) retains the default SCIM token and (b) exposes the SCIM endpoint to an attacker's network position. Because the identity service is typically a trust anchor, downstream SSO-integrated applications inherit the risk. No EPSS score, CVSS score, vendor fix, or workaround is currently published, and the CVE is not in CISA KEV, so prioritization must rely on internal exposure assessment rather than external scoring. Note that the affected release train has no remediation path other than upgrading to 2026.1; earlier versions will remain vulnerable permanently.

Detection Guidance

Sigma Rule

title: Perforce HAS SCIM Default Bearer Token Authentication Attempt
id: 6b2f9c14-8e21-4d3a-9f77-1c0e5a7b23d4
status: experimental
description: Detects authentication to the Perforce Helix Authentication Service SCIM API using the shipped default bearer token, indicating exploitation of CVE-2026-109758.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109758
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: perforce
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/scim'
      - '/scim/v2'
  selection_auth_header:
    cs(Authorization)|contains: 'Bearer'
  filter_legit_token:
    cs(Authorization)|contains: 'RotatedTokenPlaceholder'
  condition: selection_endpoint and selection_auth_header and not filter_legit_token
falsepositives:
  - Legitimate provisioning clients using rotated tokens (tune filter_legit_token)
level: high

YARA Rule

rule CVE_2026_109758_HAS_Default_SCIM_Token
{
    meta:
        description = "Detects Perforce HAS configuration artifacts retaining the shipped default SCIM bearer token"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109758"
        cve = "CVE-2026-109758"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $scim = "scim" ascii nocase
        $token_kw = "bearer" ascii nocase
        $default_kw = "default" ascii nocase
        $has = "Helix Authentication Service" ascii nocase
    condition:
        filesize < 5MB and
        (($has and $scim) or ($scim and $token_kw and $default_kw))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109758 Perforce HAS SCIM API Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/scim"; http.header; content:"Authorization"; http.header; content:"Bearer"; classtype:attempted-admin; sid:2026109758; rev:1;)

Elastic Detection

network where
  http.request.method in ("GET", "POST", "PATCH", "PUT", "DELETE") and
  stringContains(url.path, "/scim") and
  stringContains(http.request.headers.Authorization, "Bearer")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=perforce:has
| search uri_path="*scim*" ("Authorization"="*Bearer*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, http_method
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="perforce,scim,web,">
  <rule id="109758" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/scim</match>
    <regex>Authorization:\s*Bearer</regex>
    <description>CVE-2026-109758: SCIM API access with bearer token against Perforce HAS</description>
    <group>cve_2026_109758,authentication_failed,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor fix, workaround, or tracked patch source for affected versions 2022.1 - 2025.2.

1. Immediate mitigations.

   • Rotate the SCIM bearer token on every HAS deployment in the 2022.1–2025.2 range. Search active configuration files and installation templates for the shipped default token and replace it with a high-entropy random value.
   • Restrict network access to the SCIM endpoint using firewall rules, ACLs, or a reverse proxy so that only authorized provisioning hosts can reach it. An attacker cannot exploit a token they cannot reach.
   • Audit configured provisioning backends to enumerate exactly which user and group operations are exposed, and review identity logs for unauthorized changes.

2. Patch / upgrade steps.

   • Upgrade to HAS version 2026.1 (released July 17, 2026), the only release in which the underlying defect is removed. Because affected versions 2022.1–2025.2 will not receive a fix, upgrade is the sole durable remediation.
   • Verify after upgrade that the configured SCIM token is unique per deployment and that scim-patch is updated to a version not affected by CVE-2026-61834.

3. Long-term hardening.

   • Enforce automated secret generation at install/config time to eliminate shipped default credentials from templates.
   • Add deployment-time checks (CI or config scanning) that fail builds when default or placeholder secrets remain in active configuration.
   • Segment identity services so HAS is never directly reachable from untrusted networks.
   • Monitor for chained exploitation: watch PATCH requests to SCIM endpoints and track indicators of prototype-pollution gadget usage (child_process, EJS/Pug, Passport) on HAS hosts running Node.js 24/Express.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109758
• NVD (chained): https://nvd.nist.gov/vuln/detail/CVE-2026-61834
• CWE-798: Use of Hard-coded Credentials — https://cwe.mitre.org/data/definitions/798.html
• Perforce Helix Authentication Service product documentation (vendor site) — https://www.perforce.com/products/helix-core
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-109758: not listed)

No public proof-of-concept or exploit code is available for CVE-2026-109758, and no in-the-wild exploitation or named threat actor campaign has been observed in the provided data. The chain with CVE-2026-61834 has been confirmed only in a controlled test (Node.js 24/Express).