Vulnerability · Published Oct 29, 2026 · Assigned by OpenText
CVE-2026-112256Logon bypass (trust of attacker-controlled completed-methods list)
Critical 9.2
In plain English
A critical-severity security flaw in Advanced Authentication Server from OpenText. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenText | Advanced Authentication Server | 6.4.0.0 – through 6.4.3.86.5.0.0 – through 6.5.0.106.6.0.0 – through 6.6.1.0 |
Weakness: CWE-349 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/AU:Y/V:C/RE:M/U:Red
References
- https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662 release-notes
- https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662 release-notes
- https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439
- https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011