Live › vulnerability › CVE-2026-112255
OpenText Advanced Authentication Server ships with an insecure default that lets resources be initialized in a way that causes excessive allocation. The sources say the fix is a secure configuration that stops creation of Unauthenticated Endpoints, or restricts it to a non-empty whitelist of trusted networks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Organizations running OpenText Advanced Authentication Server in the affected version ranges, where Unauthenticated Endpoints can be created or recreated. Exposure depends on the configuration: if creation is disabled, or the whitelist is non-empty and limited to trusted networks, the risk is reduced. Teams on versions outside the listed ranges can skip it.
No product ranges from the sources yet.
6.4.0.0 through 6.4.3.x, 6.5.0.0 through 6.5.0.x, and 6.6.0.0 through 6.6.1.0.6.6.2.0: has a best-practice entry that flags an insecure configuration.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.
This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.
The fix for this is issue is to create a secure configuration. The 6.6.2.0 release has a best practice entry if the configuration is unsecure.
A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints. If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.
To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks. An empty whitelist will allow all networks to create/recreate endpoints.
This page as .md · .json · in your agent: get_signal("CVE-2026-112255")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.