CVE-2026-112255: Endpoint credential minting (insecure default allow-list)
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.
This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.
The fix for this is issue is to create a secure configuration. The 6.6.2.0 release has a best practice entry if the configuration is unsecure.
A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints. If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.
To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks. An empty whitelist will allow all networks to create/recreate endpoints.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not allow creation or recreation of Unauthenticated Endpoints. If this functionality is required, use a non-empty whitelist containing only trusted networks; an empty whitelist allows all networks.
OpenText Advanced Authentication Server Unauthenticated Endpoint creation/recreation = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Advanced Authentication Server deployments in the affected version ranges are exposed when their configuration allows creation or recreation of Unauthenticated Endpoints. An empty whitelist is insecure because it permits all networks to create or recreate endpoints.
What does an attacker need to exploit the issue?
An attacker needs network access to an affected server that permits creation or recreation of Unauthenticated Endpoints from their network. No authentication or user interaction is required according to the supplied severity vector.
Does the default configuration create risk?
The issue is described as an insecure default allow-list condition. A configuration with an empty whitelist allows all networks to create or recreate Unauthenticated Endpoints.
What should be done if Unauthenticated Endpoints are required?
Configure a non-empty whitelist containing only trusted networks. If those endpoints are not required, disable their creation and recreation entirely.
How can administrators determine whether they are affected?
Review the Advanced Authentication Server version and the Unauthenticated Endpoints configuration. Systems are affected if they fall within the listed version ranges and permit endpoint creation or recreation without a non-empty trusted-network whitelist.