CVE-2026-109758: CWE-1321 Improperly controlled modification of object prototype attributes ('prototype pollution') in Perforce Helix Authentication Service

Perforce Helix Authentication Service (HAS) deployments that retain the default SCIM bearer token shipped in installation templates are vulnerable to unauthorized access if the SCIM endpoint is reachable. Attackers knowing this token can authenticate to the SCIM API and manipulate user and group provisioning. This vulnerability affects versions from 2022.1 up to but not including 2026.1. Furthermore, this issue can be chained with CVE-2026-61834 in the scim-patch dependency, where a crafted SCIM PATCH request causes server-side prototype pollution (CWE-1321), corrupting application state and disrupting service availability. This prototype pollution primitive was confirmed to enable remote code execution in Node.js 24/Express deployments via known gadget chains. The underlying defect was removed in HAS version 2026.1.

An attacker who knows the default SCIM bearer token can gain unauthorized access to the SCIM API, allowing them to perform user and group operations permitted by the provisioning backend. The chained prototype pollution vulnerability can corrupt application state, disrupt service availability including health checks and SCIM or SSO requests, and enable remote code execution in certain Node.js environments. The CVSS 4.0 score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

A fixed version, 2026.1, was released on July 17, 2026, which removes the underlying defect. Users should upgrade to version 2026.1 or later to remediate this vulnerability. Since this is not a cloud service, remediation requires applying the official update. Patch status is confirmed by the vendor advisory indicating the defect removal in 2026.1. Until upgrade, ensure the default SCIM bearer token is replaced with a secure random token and restrict access to the SCIM endpoint to trusted networks only.