9.2Critical
CVE-2026-112256Logon bypass (trust of attacker-controlled completed-methods list)
Description
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
Weakness (CWE):
CWE-349
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| OpenText | Advanced Authentication Server | 6.4.0.0 – ≤ 6.4.3.8, 6.5.0.0 – ≤ 6.5.0.10, 6.6.0.0 – ≤ 6.6.1.0 |
References and patches
- https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662 release-notes
- https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662 release-notes
- https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439
- https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011