Perforce Helix Authentication Service (HAS) includes a hard‑coded SCIM bearer token that is copied into the active configuration during installation. If an attacker can reach the SCIM endpoint and knows this default token, they can authenticate and execute any user or group modification that the provisioning backend permits. An additional flaw in the scim‑patch library (CVE‑2026‑61834) can be chained, allowing a crafted PATCH request to trigger prototype pollution, corrupt internal state, disrupt service availability, and in some Node.js conditions enable arbitrary code execution. The vulnerability existed in HAS versions 2022.1 through 2025.2 and was remedied in version 2026.1, which removed the hard‑coded credential.

The flaw occurs in Perforce Helix Authentication Service versions 2022.1 through 2025.2, which retain the default SCIM bearer token. The issue was resolved in version 2026.1, released July 17, 2026. Systems that have not yet upgraded to 2026.1 and expose the SCIM endpoint remain vulnerable.

With a CVSS score of 9.3, the vulnerability is considered high severity and can be exploited remotely without any special account, simply by knowing the fixed token. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, yet the presence of a known default credential makes exploitation likely in environments where the SCIM endpoint is exposed to the Internet or an uncontrolled internal network. The risk is amplified by the potential for chained exploitation that can achieve remote code execution, although the vulnerability is not yet listed in CISA KEV.