Skip to content
Sign in
5.3 Medium

CVE-2026-18159 A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking

Description

A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking. This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
Passive
Confidentiality
None
Integrity
Low
Availability
None
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
OpenText Directory Services (OTDS) 26.2 earliest → < 26.2.5 26.2.5
OpenText Directory Services (OTDS) 26.1 earliest → < 26.1.8 26.1.8
OpenText Directory Services (OTDS) 25.4 earliest → < 25.4.11 25.4.11
OpenText Directory Services (OTDS) 25.3 earliest → < 25.3.13 25.3.13
OpenText Directory Services (OTDS) 25.2 earliest → < 25.2.11 25.2.11
OpenText Directory Services (OTDS) 25.1 earliest → < 25.1.12 25.1.12
OpenText Directory Services (OTDS) 24.4 earliest → < 24.4.22 24.4.22
OpenText Directory Services (OTDS) 24.3 earliest → < 24.3.7 24.3.7
OpenText Directory Services (OTDS) 24.2 earliest → < 24.2.8 24.2.8
Show the 7 other branches
Product Affected versions Fixed in
OpenText Directory Services (OTDS) 24.1 earliest → < 24.1.11 24.1.11
OpenText Directory Services (OTDS) 23.4 earliest → < 23.4.20 23.4.20
OpenText Directory Services (OTDS) 23.3 earliest → < 23.3.11 23.3.11
OpenText Directory Services (OTDS) 23.2 earliest → < 23.2.8 23.2.8
OpenText Directory Services (OTDS) 23.1 earliest → < 23.1.10 23.1.10
OpenText Directory Services (OTDS) 22.4 earliest → < 22.4.21 22.4.21
OpenText Directory Services (OTDS) 10.5 10.5 → 26.2 No fix stated

Other CVEs of OpenText Directory Services (OTDS)

The 3 CVEs of OpenText Directory Services (OTDS) →
CVE-2026-76580 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText… 6.3 Medium CVE-2026-19134 A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering 7.1 High
Track this CVE