Perforce Helix Authentication Service: Hard-coded default SCIM bearer token

Summary

Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 ship with a default SCIM bearer token that the installer copies into the active configuration without replacing it. An attacker who knows this static token and can reach the SCIM endpoint can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. The issue can be chained with CVE-2026-61834 in the scim-patch dependency. The vendor's CVE title refers to remote code execution via prototype pollution, but RCE is not confirmed in the vendor advisory.

Affected

• Perforce Helix Authentication Service 2022.1 through 2025.2
• Dependency scim-patch before 0.9.2 (CVE-2026-61834) in affected releases; bundled version per HAS release unknown
• Default configurations that retain the shipped SCIM bearer token and expose the SCIM endpoint

Fixed in

• Perforce Helix Authentication Service 2026.1 (released July 17, 2026)
• scim-patch 0.9.2 for the chained dependency issue

Workaround

• Rotate the SCIM bearer token to a unique random value, since the installer does not do this automatically
• Restrict network access to the SCIM endpoint to the identity provider or other trusted sources (recommendation, not a vendor statement)
• Verify the current token-handling procedure in the admin guide
• No vendor-documented interim workaround found; upgrading is the primary fix

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalog; no reports of exploitation found
• No public exploit code confirmed
• CISA SSVC: exploitation none, automatable yes, technical impact total
• The chained scim-patch issue (CVE-2026-61834) is marked with a proof of concept in CISA ADP SSVC data

Our recommendation

• Upgrade Perforce Helix Authentication Service to 2026.1 or later
• If upgrading is not immediately possible, rotate the SCIM bearer token and restrict SCIM endpoint access
• Check whether SCIM is enabled and whether the endpoint is reachable from the internet or untrusted networks; treat internet-reachable deployments as high priority
• Review the scim-patch version in your HAS installation and lockfiles and update to 0.9.2 or later
• Review SCIM provisioning logs for unexpected user or group changes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record data (Vulners) vulners.com
• Strix CVE analysis www.strix.ai
• VulDB entry vuldb.com
• WorkOS: Securing SCIM endpoint workos.com
• OSV: CVE-2026-61834 (scim-patch) osv.dev
• OpenCVE: CVE-2026-61834 app.opencve.io
• Perforce HAS release notes 2024.2 perforce.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:23.