9.2
Critical
CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list)
Description
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/AU:Y/V:C/RE:M/U:RedExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- High
- Integrity
- High
- Availability
- None
- Confidentiality of other systems
- High
- Integrity of other systems
- High
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Advanced Authentication Server 6.6 | 6.6.0.0 → 6.6.1.0 | No fix stated |
| Advanced Authentication Server 6.5 | 6.5.0.0 → 6.5.0.10 | No fix stated |
| Advanced Authentication Server 6.4 | 6.4.0.0 → 6.4.3.8 | No fix stated |