Auth bypass in Black Duck Coverity

CVE-2026-1496

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.005 (38.6th percentile) — read the EPSS interpretation.