Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

OpenText Advanced Authentication Server lets attacker bypass login

CVE-2026-112256 · published 5 days ago
Summary

The Advanced Authentication Server versions listed can be tricked into accepting forged login data, allowing someone to get in without proper permission checks. This means unauthorized users could access functions they shouldn’t see. Update the server to the latest version or apply the vendor’s patch to close the gap.

What to do
  • Update opentext advanced authentication server to version 6.4.3.9.
Affected software
VendorProductAffected versions
opentext advanced authentication server <= 6.4.3.8
Fix: upgrade to 6.4.3.9
Original advisory text
Logon bypass (trust of attacker-controlled completed-methods list)
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
References
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
Timeline
Published29 Oct 2026
Updated30 Oct 2026
First seen29 Oct 2026
Sources
CVE-2026-112256 · NVD
CVE-2026-112256 · MITRE
Track software like this
Free during beta