CVE-2026-1496

CVE-2026-1496 is a critical authentication bypass vulnerability affecting vulnerable versions of Coverity Connect's command line tooling. This flaw, rated CVSS 9.3, allows an unauthenticated attacker with network access to the /token API endpoint to bypass authentication by knowing or guessing a valid username. Successful exploitation grants the attacker all roles and privileges of the compromised user's account, leading to high confidentiality and integrity impact. While no public exploit code or active exploitation has been observed, the low attack complexity and severe impact necessitate prompt patching.