CVE-2026-103510
Authentication bypass via blank auth token in P4Search
- State
- Published
- Severity
- 9.5 Critical
- Published
- Oct 5, 2026
- Updated
- Oct 5, 2026
- Reserved
- Sep 30, 2026
Description
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.5 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | Perforce |
Weaknesses
- CWE-636 Not Failing Securely ('Failing Open')
Affected Products
| Product | Versions |
|---|---|
P4 (Helix Core)Perforce |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.