VULNERABILITY INTELLIGENCE
CVE-2026-1496
EPSS probability0.55%
CISA KEVNot currently listed
Published2026-03-27
Last modified2026-10-26
Description
Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.
Weakness classification
- disclosure@synopsys.com: CWE-639