CVE-2026-1496

CVE-2026-1496 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.. EPSS estimates a 0.48% chance of exploitation in the next 30 days.