A Spring Security authentication and authorization bypass exists in Coverity Connect that allows an unauthenticated attacker to send a specially crafted HTTP request and gain access to data within the platform. The flaw permits bypassing both authentication checks and authorization controls on specific API endpoints, resulting in an unauthorized disclosure of potentially sensitive information. The weakness relies on a flaw in the handling of authentication headers and request validation, categorized as authentication bypass by spoofing (CWE‑288).

Black Duck:Coverity Connect versions between 2023.6.0 and 2026.3.0 are affected by the vulnerability. Users running any release in that range must update to a patched version or beyond 2026.3.0 to remove the flaw.

The CVSS score of 9.2 indicates a high severity, while the EPSS score of less than 1% suggests the exploitation likelihood is currently low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an unauthenticated attacker sending a specially crafted HTTP request to the target API endpoints, implying that a network actor—potentially on the same local network or with external access to the Coverity Connect service—could leverage this bypass. No additional privileged access or system compromise is required to exploit the flaw.