by Kastro
Paper/Archive/CVE-2026-112256

CVE-2026-112256

OpenText Advanced Authentication Server — Logon bypass (trust of attacker-controlled completed-methods list)

CVSS 9.2
critical.is priorityof 100
28
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.

Affected

ProductAffectedFixed inSource
Advanced Authentication Server6.4.0.0 – 6.4.3.8–CNA
Advanced Authentication Server6.5.0.0 – 6.5.0.10–CNA
Advanced Authentication Server6.6.0.0 – 6.6.1.0–CNA

Scores by source

OpenText (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/AU:Y/V:C/RE:M/U:Red

References

refdocs.microfocus.com/doc/42/26.3.1/security-improvements-662refdocs.microfocus.com/doc/2582/26.3.1/security-improvements-662refdocs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439refdocs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011