CVE-2026-1496: Coverity Connect Authentication Bypass via /token Endpoint
CVE-2026-1496 is a critical authentication bypass in Coverity Connect, caused by a missing error handler in the authentication logic used by command line tooling. According to the record, an attacker who knows or guesses a valid username could use a crafted HTTP request to the /token endpoint to assume that user's roles and privileges. No confirmed exploitation appears in the sources consulted, and the record does not list affected or fixed versions.
Overview
CVE-2026-1496 is an authentication bypass in Coverity Connect. The record states that the authentication logic used by command line tooling lacks an error handler. This affects requests to the /token API endpoint. The CNA contact is disclosure@synopsys.com, and the record includes a Black Duck security advisory for this CVE.
Impact
- The record describes a path to authentication bypass when a valid username is known or guessed.
- Successful exploitation would let an attacker assume all roles and privileges of the targeted Coverity Connect account.
- The CVSS 4.0 base score in the record is 9.3, with the attack vector listed as network and no privileges or user interaction required.
- The CWE classification is CWE-639, authorization bypass through a user-controlled key.
Affected products and versions
- The record describes vulnerable versions of Coverity Connect but does not list specific affected version ranges.
- The affected list in the record is empty, so exact versions must be confirmed with the vendor advisory.
Exploitation status
- The CISA KEV catalog does not list this CVE in the record.
- No confirmed exploitation appears in the sources consulted.
- The EPSS probability in the record is 0.00478 with a percentile of 0.39534.
Remediation and mitigation
- Review the Black Duck security advisory for the vendor's official fix guidance and version information.
- Review the mitigation guidance for WAF, IDS and IPS and the instructions on restricting the token endpoint as interim measures, following vendor instructions.
- Limit network exposure of the Coverity Connect instance and review which accounts are reachable through command line tooling.
Detection guidance
- Review web and application logs for unusual volume or patterns of requests to the token endpoint.
- Correlate authentication events with unexpected activity from accounts that have high privileges.
- Monitor for sessions that perform administrative actions without a matching change request.
Limitations of the available information
- The record does not list affected or fixed versions, so the scope of impact cannot be fully determined from it.
- The record does not include the full vendor advisory text, so the details of the fix are unknown.
- The EPSS date in the record is later than the publication date, so the scoring context should be verified against the current source.
Frequently asked questions
What is CVE-2026-1496?
It is a critical authentication bypass in Coverity Connect. According to the record, it stems from a missing error handler in authentication logic used by command line tooling.
Is this vulnerability being actively exploited?
The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The record does not list specific affected or fixed versions. Consult the vendor advisory from Black Duck for version details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.