Live › vulnerability › CVE-2026-112256
OpenText Advanced Authentication Server accepts extra untrusted data alongside trusted data, which bypasses access control checks. An attacker can reach functionality that should be restricted to authorized users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Organizations running self-hosted OpenText (NetIQ) Advanced Authentication Server 6.4.0.0-6.4.3.8, 6.5.0.0-6.5.0.10 or 6.6.0.0-6.6.1.0. The CNA's CVSS vector indicates it is reachable over the network without credentials, so any instance whose server is reachable by untrusted networks is the priority. Versions outside these ranges can skip it; no fixed version has been published in the sources read.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Advanced Authentication Server | vendor | >= 6.4.0.0, <= 6.4.3.8; >= 6.5.0.0, <= 6.5.0.10; >= 6.6.0.0, <= 6.6.1.0 | – |
6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and through .6.6.0.06.6.1.0No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-112256")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.