PT-2026-28312 · Synopsys · Coverity Connect

Huong Kieu · Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-1496

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Coverity Connect (affected versions not specified)

Description The authentication logic in the command line tooling for Coverity Connect is missing an error handler, leading to a potential authentication bypass. An attacker with access to the /token API endpoint and knowledge of a valid username can craft a specific HTTP request to bypass authentication. Successful exploitation allows an attacker to assume the privileges of the legitimate user. The /token API endpoint is involved in this issue. The username is a vulnerable parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-1496

Produtos afetados

Coverity Connect

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1496 · Nota de Segurança
• https://community.blackduck.com/s/article/Instructions-on-how-to-block-token-endpoint-for-Coverity-Connect · Aviso do Fabricante
• https://github.com/blackduck-inc/Coverity-Usage-Log-Analyzer · Nota
• https://community.blackduck.com/s/article/WAF-IDS-IPS-Mitigation-Guidance · Aviso do Fabricante
• https://community.blackduck.com/s/article/Black-Duck-Security-Advisory-CVE-2026-1496 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2037536264002375923 · Publicação no Twitter