CVE-2026-1496

Katalog CVE

CVSS 9.3 · Critical EPSS 0,48%

Kerentanan Authorization Bypass Through User-Controlled Key. Skor CVSS 4.0 9.3 (Critical) menurut synopsys.com.

Deskripsi (NVD)

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Awaiting Analysis

CVSS 4.0

9.3 (Critical), sumber synopsys.com
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://community.blackduck.com/s/article/Black-Duck-Security-Advisory-CVE-2026-1496
• https://community.blackduck.com/s/article/Instructions-on-how-to-block-token-endpoint-for-Coverity-Connect
• https://community.blackduck.com/s/article/WAF-IDS-IPS-Mitigation-Guidance
• https://github.com/blackduck-inc/Coverity-Usage-Log-Analyzer