Vulnerability · Published Mar 27, 2026 · Assigned by BlackDuck
CVE-2026-1496Coverity CLI Authentication Bypass
Critical 9.3
In plain English
A critical-severity authorization bypass via user-controlled key in Coverity from Black Duck. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Official description
Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Black Duck | Coverity | 2024.3.0 – before 2025.12.0 |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References
- https://community.blackduck.com/s/article/Black-Duck-Security-Advisory-CVE-2026-1496 vendor-advisory
- https://community.blackduck.com/s/article/Instructions-on-how-to-block-token-endpoint-for-Coverity-Connect vendor-advisory, mitigation
- https://community.blackduck.com/s/article/WAF-IDS-IPS-Mitigation-Guidance vendor-advisory, mitigation
- https://github.com/blackduck-inc/Coverity-Usage-Log-Analyzer related