CVE-2026-112256

CriticalCVSS 9.2

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

OpenText Advanced Authentication Server contains an acceptance of extraneous untrusted data with trusted data vulnerability that allows accessing functionality not properly constrained by ACLs. This affects versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0.

Risk Assessment

An attacker may access functionality that should be protected by ACLs, potentially leading to unauthorized operations within the authentication system.

Recommendation

Update OpenText Advanced Authentication Server to a version outside the listed ranges and verify ACL configuration.

Other vulnerabilities in OpenText Advanced Authentication Server

CVE-2026-112255Low
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix is to create a secure configuration; the 6.6.2.0 release has a best practice entry if the configuration is insecure.

Original NVD description (English source)

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS