Helix Authentication Service CVE-2026-109758

Exploitation requires three concrete conditions from the description: (1) the HAS deployment still uses the shipped DEFAULT SCIM bearer token - the installer and config script copy this default into active configuration and do not auto-generate a random token, so default/unmodified installs are vulnerable out of the box; (2) the SCIM API endpoint is network-reachable by the attacker; and (3) SCIM provisioning is configured/enabled against a backend. For the RCE escalation specifically, the deployment must run the vulnerable scim-patch dependency and a Node.js 24/Express stack exposing usable gadget chains (child_process, EJS/Pug, or Passport). LIMITING FACTORS: operators who manually rotated the SCIM token are not exploitable; the affected version window is 2022.1-2025.2 (2026.1 removes the defect); and the full RCE impact depends on the runtime gadget environment, whereas unauthorized SCIM user/group operations apply to any unpatched default install.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3 Critical) is internally consistent with the description: the SCIM endpoint is network-reachable and the shipped default bearer token is copied into active config and never auto-rotated, so an attacker needs no legitimate credentials - only knowledge of a publicly-shipped default, which CVSS correctly treats as PR:N. The chain with CVE-2026-61834 (prototype pollution in the scim-patch dependency, CWE-1321) escalates full-token abuse into confirmed RCE on Node.js 24/Express deployments via child_process/EJS/Pug/Passport gadget chains, justifying VC:H/VI:H/VA:H. CONFLICTING/MISSING SIGNALS: No EPSS score, no CISA KEV listing, and no POC indicator were provided, so exploitation-likelihood signals are absent rather than low - do not read the missing EPSS as reassurance. The one tempering factor is that RCE is partially deployment-dependent (default token retained + specific Node/Express gadget environment), so the pure auth-bypass (unauthorized SCIM user/group operations) is universally applicable to unpatched default installs, while the RCE outcome depends on the runtime stack. Net: treat as critical for any HAS deployment that has not rotated the SCIM token.

An attacker enumerates an internet- or network-reachable Helix Authentication Service SCIM endpoint and authenticates using the well-known default bearer token that the installer never replaced. They then issue a crafted SCIM PATCH request that triggers server-side prototype pollution in the scim-patch dependency, which the vendor confirmed can be driven to remote code execution via available gadget chains in a Node.js 24/Express deployment. No public exploit was identified at time of analysis, but the vendor states RCE was reproduced in testing.