{"id":"CVE-2026-112255","kind":"vulnerability","aliases":["CVE-2026-112255"],"related":[],"title":"OpenText Advanced Authentication Server: insecure default allows excessive resource allocation","description":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.\n\n\n\nThe fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.\n\n\n\nA secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  \n\n\n\nTo remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.","summary":"OpenText Advanced Authentication Server ships with an insecure default that lets resources be initialized in a way that causes excessive allocation. The sources say the fix is a secure configuration that stops creation of Unauthenticated Endpoints, or restricts it to a non-empty whitelist of trusted networks.","severity":"low","cvss":2.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["advanced-authentication-server","opentext","self-hosted","vendor"],"not_affected_if":["default-config-changed","versions-outside-affected-ranges"],"how_to_check":"- Review the Advanced Authentication Server configuration for the setting controlling creation or recreation of Unauthenticated Endpoints and its network whitelist.\n- Check the installed version against the affected ranges: `6.4.0.0` through `6.4.3.x`, `6.5.0.0` through `6.5.0.x`, and `6.6.0.0` through `6.6.1.0`.","fix":"- Advanced Authentication Server `6.6.2.0`: has a best-practice entry that flags an insecure configuration.\n- Change configuration to disallow creation/recreation of Unauthenticated Endpoints; if they are required, set a non-empty whitelist of trusted networks (an empty whitelist allows all networks).","status":"open","published_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:32:11+00:00","updated_at":"2026-10-29T16:32:11+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-29T16:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- Advanced Authentication Server `6.6.2.0`: has a best-practice entry that flags an insecure configuration.\n- Change configuration to disallow creation/recreation of Unauthenticated Endpoints; if they are required, set a non-empty whitelist of trusted networks (an empty whitelist allows all networks).","reach":"network","title":"OpenText Advanced Authentication Server: insecure default allows excessive resource allocation","impact":"low","summary":"OpenText Advanced Authentication Server ships with an insecure default that lets resources be initialized in a way that causes excessive allocation. The sources say the fix is a secure configuration that stops creation of Unauthenticated Endpoints, or restricts it to a non-empty whitelist of trusted networks.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["advanced-authentication-server","opentext","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"unauthenticated attacker causes excessive resource allocation on the server","analyst_note":"","how_to_check":"- Review the Advanced Authentication Server configuration for the setting controlling creation or recreation of Unauthenticated Endpoints and its network whitelist.\n- Check the installed version against the affected ranges: `6.4.0.0` through `6.4.3.x`, `6.5.0.0` through `6.5.0.x`, and `6.6.0.0` through `6.6.1.0`.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config-changed","versions-outside-affected-ranges"],"who_is_affected":"Organizations running OpenText Advanced Authentication Server in the affected version ranges, where Unauthenticated Endpoints can be created or recreated. Exposure depends on the configuration: if creation is disabled, or the whitelist is non-empty and limited to trusted networks, the risk is reduced. Teams on versions outside the listed ranges can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.0008,"input_tokens":4377,"output_tokens":724,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112255':13A,16A '-2026':12A,15A '6.4.0.0':98C '6.4.3':100C '6.5.0':105C '6.5.0.0':103C '6.6.0.0':109C '6.6.1.0':111C '6.6.2.0':125C 'advanc':2A,18B,27B,85C,94C 'advanced-authentication-serv':17B 'affect':93C 'alloc':10A,46B,90C 'allow':7A,88C,143C,158C,172C,203C 'authent':3A,19B,28B,86C,95C 'best':129C 'caus':44B 'chang':167C,184C 'configur':55B,123C,134C,139C,169C,186C 'creat':120C 'create/recreate':207C 'creation':58B 'creation/recreation':144C,149C,173C 'cve':11A,14A 'default':6A,34B,81C 'empti':69B,192C,200C 'endpoint':61B,147C,152C,176C,181C,208C 'entri':131C 'excess':8A,45B,89C 'fix':51B,113C 'host':24B 'initi':39B,74C 'insecur':5A,33B,80C 'issu':92C,117C,166C 'let':36B 'must':183C 'network':73B,162C,198C,205C 'non':68B,191C 'non-empti':67B,190C 'opentext':1A,21B,26B,84C 'practic':130C 'releas':126C 'remedi':164C 'requir':154C,179C 'resourc':9A,37B,77C 'restrict':63B 'say':49B 'secur':54B,122C,138C 'self':23B 'self-host':22B 'server':4A,20B,29B,87C,96C 'ship':30B 'sourc':48B 'specifi':195C 'stop':57B 'trust':72B,161C,197C 'unauthent':60B,146C,151C,175C,180C 'unsecur':136C 'use':188C 'vendor':25B 'vulner':82C 'way':42B 'whitelist':70B,193C,201C 'x':101C,106C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenText Advanced Authentication Server in the affected version ranges, where Unauthenticated Endpoints can be created or recreated. Exposure depends on the configuration: if creation is disabled, or the whitelist is non-empty and limited to trusted networks, the risk is reduced. Teams on versions outside the listed ranges can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber","cvss_by":"security@opentext.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112255","severity":null,"published_at":"2026-10-29T16:17:58+00:00","modified_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}