External risk intelligence

Perforce HAS Default SCIM Token Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109758

The vulnerability involves an identity and provisioning service (SCIM API) used for authentication and user management. Such services are commonly exposed as internet-facing or edge-accessible APIs to facilitate integration with external identity providers and cloud-based user provisioning, making them a likely target for network-based access.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Perforce Helix Authentication Service (HAS) deployments that have not updated the default SCIM bearer token. If the SCIM endpoint is accessible, attackers can use this default token to gain unauthorized access and perform user and group operations. This could potentially be chained with another vulnerability to achieve remote code execution.

Default credentials allow unauthorized access to user data.
Critical service controls user identity and provisioning.
Confirm if your authentication service uses default tokens.

Attack Path

How an attacker could exploit the issue

An attacker who discovers a default, unchanged bearer token in Perforce Helix Authentication Service deployments can gain unauthorized access to the SCIM API. This access allows them to manipulate user and group information through the provisioning backend. In some scenarios, this vulnerability can be combined with another to disrupt services or potentially execute code remotely.

Exposed SCIM API with default token.
Authenticate to perform user operations.
Unauthorized access and potential RCE.

Live Threat

Current exploitation, exposure, and threat context

When Perforce Helix Authentication Service (HAS) deployments retain the default SCIM bearer token and the SCIM endpoint is accessible, an attacker could authenticate to the SCIM API. This could allow them to perform user and group operations, and when chained with another vulnerability, potentially lead to remote code execution and service disruption.

User and group data could be affected.
Unauthorized SCIM API access could occur.
Service disruption and potential code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Perforce Helix Authentication Service (HAS) team, application owners, and infrastructure teams are responsible for addressing this vulnerability. The immediate first step is to identify all HAS deployments, determine their external reachability, and confirm if they are business-critical. Remediation planning should prioritize these highly exposed or critical instances.

Identify all HAS deployments and exposure.
Confirm business criticality and accountable owners.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Perforce Helix Authentication Service?

The Perforce Helix Authentication Service (HAS) is a component used to manage user identity and provisioning for Perforce environments. It acts as an integration point, often utilizing the SCIM (System for Cross-domain Identity Management) API to communicate with external identity providers. This service ensures that user and group information is synchronized and authenticated across the platform's infrastructure.

How do these vulnerabilities affect my Perforce system?

The issues involve using default credentials (CWE-798) and potential prototype pollution (CWE-1321). Because the installation process defaults to a static bearer token, unauthorized users could access the SCIM API to manage accounts. Furthermore, a secondary flaw in a dependency allows for malicious data manipulation that can disrupt the service or even lead to remote code execution.

What triggers this security flaw?

The primary trigger is the presence of the default SCIM bearer token in your active configuration. If this token has not been replaced with a secure, random value and your SCIM API endpoint is reachable, the system is vulnerable. Internal-only deployments where the SCIM API is strictly blocked from network access are not subject to the same immediate risk from external actors.

Is my instance relevant based on Halo Surface Signal?

Yes, if your service is internet-facing or edge-accessible. Halo Surface Signal identifies that because the SCIM API is designed to bridge with cloud providers and external identity management tools, it is frequently placed in positions that make it a likely target for network-based access attempts.

How should I respond to this threat?

Start by auditing your HAS deployments to locate instances that still use the default installation templates. Confirm if the SCIM token has been updated to a unique, random string and restrict network access to the API endpoint wherever possible. Prioritize updating to version 2026.1, which removes the underlying defects, for all business-critical instances.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.