EUVD-2026-92307
GHSA-mv4f-7chx-wrhv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable service (AV:N), low complexity spoof of client IP (AC:L), requires a stolen valid ticket so PR:L; limited data access/modification as ticket owner yields C:L/I:L/A:N.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
1DescriptionCVE.org
Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.
AnalysisAI
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a client-supplied address when validating certain authentication requests, allowing a holder of a stolen P4 Server ticket to defeat ticket host-binding and trusted-address restrictions and obtain access to P4 Search as that ticket's owner. The flaw is authenticated in nature (CVSS:4.0 vector shows PR:L and the independent assessment concurs), so it does not grant access on its own - the attacker must already possess a valid but stolen ticket, and the bypass is only meaningful in deployments that rely on host-binding or trusted-address controls; where those controls are absent, the stolen ticket already grants the same access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already possess a valid but stolen P4 Server ticket, AND that the deployment relies on host-based ticket restrictions or trusted-address controls - if those host-binding controls are not configured, there is nothing to bypass and the ticket alone already grants access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity, defense-in-depth bypass rather than a standalone critical flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade P4 Search to 2026.4.2 or later, which corrects the address validation; confirm the exact build in your deployment before and after applying, and track the vendor advisory at https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/ticket-hostbinding-bypass-via-spoofed-client-ip-in-p4search for any revised guidance: vendor-released patch is P4 Search 2026.4.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in P4 Helix Core
View allUnauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images pri
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exp
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remo
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Se
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds super-user or
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today