EUVD-2026-44930
GHSA-wpgf-w64m-w6wv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Perforce) · only source for this CVE.
CVSS VectorVendor: Perforce
Lifecycle Timeline
2DescriptionCVE.org
A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account.
AnalysisAI
Brute-force protection bypass in Perforce Delphix Continuous Data lets remote attackers defeat the account lockout mechanism by firing concurrent authentication requests that race the failed-login counter, allowing unlimited password guessing against a targeted account. The flaw is a time-of-check/time-of-use race (CWE-307) rather than a direct code-execution bug, and no public exploit identified at time of analysis. It matters because it silently neutralizes a control administrators rely on to stop credential-stuffing and password-spraying.
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that
Remote code execution in Perforce Akana API Platform allows unauthenticated attackers to run arbitrary code on the Polic
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. Rated
An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2.
XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse im
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input dat
Helix Core Server (P4D) before 2026.1 ships with insecure default configurations allowing remote unauthenticated attacke
In Helix Sync versions prior to 2024.1, a local command injection was identified. Rated high severity (CVSS 7.8), this v
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
In versions of Akana API Platform prior to 2024.1.0, SAML tokens can be replayed. Rated high severity (CVSS 7.5), this v
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified.
In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was id
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today