CVE-2026-103512

UNKNOWN 0.0

Ticket host-binding bypass via spoofed client IP in P4Search

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.

CWE	CWE-290
Vendor	perforce
Product	p4 (helix core)
Published	Oct 5, 2026

Stay Ahead of the Next One

Get instant alerts for perforce p4 (helix core)

Be the first to know when new unknown vulnerabilities affecting perforce p4 (helix core) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Perforce / P4 (Helix Core)

0 ≤ 2026.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

portal.perforce.com: https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/ticket-hostbinding-bypass-via-spoofed-client-ip-in-p4search

Credits

Khoa Bui (https://github.com/zenniskayy2k4)