CVE-2026-112256: Logon bypass (trust of attacker-controlled completed-methods list)
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
Event History
Frequently Asked Questions
Which Advanced Authentication Server releases should be checked?
Affected releases are 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0.
Does exploitation require authentication or user interaction?
The provided CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What operational impact is indicated by the severity data?
The CVSS data indicates high impact to confidentiality and integrity for the vulnerable component and subsequent systems, while availability impact is marked as none.
What mitigation is specified if an affected system cannot be updated immediately?
The provided data does not specify a workaround or compensating mitigation.