---
id: "CVE-2026-112255"
kind: "vulnerability"
aliases: ["CVE-2026-112255"]
title: "OpenText Advanced Authentication Server: insecure default allows excessive resource allocation"
severity: "low"
cvss: 2.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["advanced-authentication-server", "opentext", "self-hosted", "vendor"]
not_affected_if: ["default-config-changed", "versions-outside-affected-ranges"]
published_at: "2026-10-29T16:17:58+00:00"
first_seen_at: "2026-10-29T16:25:56+00:00"
updated_at: "2026-10-29T16:32:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112255", "first_seen_at": "2026-10-29T16:25:56+00:00"}]
---

# OpenText Advanced Authentication Server: insecure default allows excessive resource allocation

OpenText Advanced Authentication Server ships with an insecure default that lets resources be initialized in a way that causes excessive allocation. The sources say the fix is a secure configuration that stops creation of Unauthenticated Endpoints, or restricts it to a non-empty whitelist of trusted networks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Review the Advanced Authentication Server configuration for the setting controlling creation or recreation of Unauthenticated Endpoints and its network whitelist.
- Check the installed version against the affected ranges: `6.4.0.0` through `6.4.3.x`, `6.5.0.0` through `6.5.0.x`, and `6.6.0.0` through `6.6.1.0`.

## Fix

- Advanced Authentication Server `6.6.2.0`: has a best-practice entry that flags an insecure configuration.
- Change configuration to disallow creation/recreation of Unauthenticated Endpoints; if they are required, set a non-empty whitelist of trusted networks (an empty whitelist allows all networks).

## Timeline

- 2026-10-29T16:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112255

## From the sources

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.

This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.



The fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.



A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  



To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_