Organisations at risk: Perforce Helix Auth Service critical flaw enables RCE via default token chain

Organisations using older versions of Perforce Helix Authentication Service face a severe risk of remote code execution due to a default token vulnerability. The National Vulnerability Database has assigned CVE-2026-109758 to this issue, rating it as critical with a CVSS score of 9.3. The flaw stems from installation templates that retain a shipped default SCIM bearer token in versions up to 2025.2.

The installer and configuration script do not automatically replace this default credential with a random token. This leaves the SCIM endpoint accessible to anyone who knows the default value. According to the NVD record, an attacker who possesses this default token can authenticate to the SCIM API. They can then perform user and group operations permitted by the configured provisioning backend.

What we know

The vulnerability exists in Perforce Helix Authentication Service versions 2022.1 through 2025.2. The underlying defect was removed in version 2026.1, which was released on July 17th 2026. The issue was identified in these older versions after the patched release had already been made available. The weaknesses are classified under CWE-1321 and CWE-798.

This flaw can be chained with CVE-2026-61834, which affects the scim-patch dependency in affected releases. A crafted SCIM PATCH request can trigger server-side prototype pollution. This corrupts application state and disrupts service availability, including health checks and SCIM or SSO requests. The NVD description notes that this primitive was confirmed to enable remote code execution in testing.

In a later test, researchers confirmed that this prototype pollution primitive enables remote code execution in a Node.js 24/Express deployment. This is achieved through available gadget chains involving child_process, EJS/Pug, or Passport. The combination of the default token access and the prototype pollution chain creates a critical path for attackers to compromise the system.

Defender's checklist

• Verify if your deployment uses Perforce Helix Authentication Service versions 2022.1 to 2025.2.
• Check if the default SCIM bearer token from installation templates is still active.
• Monitor logs for unauthorised authentication attempts to the SCIM API endpoint.
• Assess if the scim-patch dependency is present and vulnerable to CVE-2026-61834.

What to do and how to stay safe: Perforce

• Audit your authentication service configurations to ensure default tokens have been replaced with unique, random values.
• Restrict network access to the SCIM endpoint so it is not reachable by untrusted networks or the public internet.
• Monitor server logs for unusual SCIM PATCH requests or unexpected prototype pollution indicators that could signal an attack.
• Plan to upgrade to version 2026.1 or later once the vendor provides an update, as this version removes the underlying defect.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Perforce Helix versions are affected by CVE-2026-109758?

The vulnerability affects Perforce Helix Authentication Service versions 2022.1 through 2025.2. Version 2026.1 and later are not affected.

How severe is this vulnerability?

The National Vulnerability Database rates CVE-2026-109758 as critical with a CVSS score of 9.3.

Can this flaw lead to remote code execution?

Yes, when chained with CVE-2026-61834, the flaw can enable remote code execution in Node.js 24/Express deployments via prototype pollution.