Unverified50% confidenceFactExact time
Perforce's SCIM implementation allows authentication using the default bearer token publicly documented in the documentation and does not mandate changing it, so an attacker only needs to know the token value to call the SCIM API with administrator privileges.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/13/2026
First Seen
Valid until: 1/11/2027
Sources
Related Entities
Related Claims
UnverifiedIf an authentication solution only receives SCIM events but does not connect them to the application's internal permission model, sessions and permissions on the application side may remain valid after a user is disabled on the IdP side, which is a vulnerability commonly flagged in security audits.67% similarUnverifiedPerforce's SCIM PATCH path parser fails to properly filter input, allowing attackers to construct malicious paths that break out of the intended attribute modification scope, and in some tests even allowing arbitrary code execution.67% similarUnverifiedPerforce disclosed the CVE-2026-109758 vulnerability, which involves issues with default tokens and a PATCH path parser in its SCIM implementation.66% similarUnverifiedFor credential types that fall outside the scope of SCIM, the industry typically needs to introduce secrets management tools (such as HashiCorp Vault and AWS Secrets Manager) or workload identity solutions (such as SPIFFE/SPIRE) to supplement governance.62% similarUnverifiedThe security of a SCIM endpoint does not depend on the protocol itself, but on implementation details.60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1019874API
curl https://kongchang.com/api/v1/knowledge/claims/1019874MCP
get_claim(id=1019874)