CVE-2026-100103
Authentication bypass via default auth token in P4Search
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server.
| CWE | CWE-1392 |
| Vendor | perfoce |
| Product | p4 (helix core) |
| Published | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for perfoce p4 (helix core)
Be the first to know when new unknown vulnerabilities affecting perfoce p4 (helix core) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Perfoce / P4 (Helix Core)
0 ≤ 2026.4.1
References
Credits
Khoa Bui (https://github.com/zenniskayy2k4)