The Helix Authentication Service ships with a default SCIM bearer token that is copied into the active configuration during installation. If the SCIM endpoint is reachable, an attacker who knows this known credential can authenticate as an authorized user and perform any user or group operation permitted by the provisioning backend. When combined with a separate flaw in the scim‑patch dependency, a crafted SCIM PATCH request can cause prototype pollution, corrupt internal state, disrupt service availability, and in some Node.js environments can lead to arbitrary code execution through child_process or templating engines. This represents a hard‑coded credential weakness (CWE‑798) and input validation flaw (CWE‑1321).

The flaw occurs in Perforce Helix Authentication Service versions 2022.1 through 2025.2, which retain the default SCIM bearer token. The issue was resolved in version 2026.1, released July 17, 2026. Systems that have not yet upgraded to 2026.1 and expose the SCIM endpoint remain vulnerable.

With a CVSS score of 9.3, the vulnerability is considered high severity and can be exploited remotely without any special account, simply by guessing the fixed token. The EPSS score is unavailable, but the presence of a known default credential makes exploitation likely in environments where the SCIM endpoint is exposed to the Internet or an uncontrolled internal network. The risk is amplified by the potential for chained exploitation that can achieve remote code execution, although the vulnerability is not yet listed in CISA KEV.