CVE-2026-103512

UNKNOWN

Description

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.

Timeline

Published:October 5th, 2026 9:17 AM

Last modified:October 5th, 2026 1:16 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-290

References & Reports

Advisories, patches, and third-party reports

https://portal.perforce.com/s/cve/a91Qi000003FDo1IAG/ticket-hostbinding-bypass-via-spoofed-client-ip-in-p4search

Source: NIST NVD · Data may lag official sources by up to one minute