{"id":"CVE-2026-112256","kind":"vulnerability","aliases":["CVE-2026-112256"],"related":[],"title":"OpenText Advanced Authentication Server: untrusted data lets attackers reach restricted functions","description":"Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.","summary":"OpenText Advanced Authentication Server accepts extra untrusted data alongside trusted data, which bypasses access control checks. An attacker can reach functionality that should be restricted to authorized users.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Advanced Authentication Server","fixed":[],"affected":">= 6.4.0.0, <= 6.4.3.8; >= 6.5.0.0, <= 6.5.0.10; >= 6.6.0.0, <= 6.6.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["advanced-authentication-server","authentication","netiq","opentext","self-hosted","vendor"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the installed Advanced Authentication Server version against the affected ranges: `6.4.0.0` through `6.4.3.8`, `6.5.0.0` through `6.5.0.10`, and `6.6.0.0` through `6.6.1.0`.","fix":null,"status":"open","published_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:27:44+00:00","updated_at":"2026-10-29T16:33:50+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-29T16:27:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"OpenText Advanced Authentication Server: untrusted data lets attackers reach restricted functions","impact":"high","summary":"OpenText Advanced Authentication Server accepts extra untrusted data alongside trusted data, which bypasses access control checks. An attacker can reach functionality that should be restricted to authorized users.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["opentext","advanced-authentication-server","self-hosted","authentication"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reaches restricted functionality on the authentication server","analyst_note":"Find the OpenText advisory and fixed versions for the affected ranges; confirm whether authentication is required and the attack vector (NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-112256).","how_to_check":"- Check the installed Advanced Authentication Server version against the affected ranges: `6.4.0.0` through `6.4.3.8`, `6.5.0.0` through `6.5.0.10`, and `6.6.0.0` through `6.6.1.0`.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Organizations running OpenText Advanced Authentication Server in the affected version ranges. The sources do not say whether default configurations or specific features are required, so exposure beyond the version ranges is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4172,"output_tokens":570,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the OpenText advisory and fixed versions for the affected ranges; confirm whether authentication is required and the attack vector (NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-112256).","search":"'-112256':14A,17A '-2026':13A,16A '6.4.0.0':89C '6.4.3.8':91C '6.5.0.0':93C '6.5.0.10':95C '6.6.0.0':98C '6.6.1.0':100C 'accept':36B,60C 'access':45B,75C 'acl':81C 'advanc':2A,22B,33B,71C,85C 'advanced':18A 'advanced-authentication-serv':21B 'affect':84C 'allow':74C 'alongsid':40B 'attack':8A,49B 'authent':3A,23B,25B,34B,72C,86C 'authentication':19A 'author':58B 'bypass':44B 'check':47B 'constrain':79C 'control':46B 'cve':12A,15A 'data':6A,39B,42B,64C,67C 'extra':37B 'extran':62C 'function':11A,52B,76C 'host':30B 'issu':83C 'let':7A 'netiq':26B 'opentext':1A,27B,32B,70C 'proper':78C 'reach':9A,51B 'restrict':10A,56B 'self':29B 'self-host':28B 'server':4A,20A,24B,35B,73C,87C 'trust':41B,66C 'untrust':5A,38B,63C 'user':59B 'vendor':31B 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted OpenText (NetIQ) Advanced Authentication Server 6.4.0.0-6.4.3.8, 6.5.0.0-6.5.0.10 or 6.6.0.0-6.6.1.0. The CNA's CVSS vector indicates it is reachable over the network without credentials, so any instance whose server is reachable by untrusted networks is the priority. Versions outside these ranges can skip it; no fixed version has been published in the sources read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:M/U:Red","cvss_by":"security@opentext.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112256","severity":null,"published_at":"2026-10-29T16:17:58+00:00","modified_at":"2026-10-29T16:17:58+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112256:1059","url":null,"severity":null,"published_at":"2026-10-29T16:33:50+00:00","modified_at":"2026-10-29T16:33:50+00:00","first_seen_at":"2026-10-29T16:33:50+00:00","fetched_at":"2026-10-29T16:33:50+00:00","note":"No OpenText advisory or fixed version found yet (searched web; only NVD, published 2026-10-29). CNA vector from security@opentext.com is CVSS 4.0 AV:N/AC:L/PR:N/UI:N, so network-reachable and unauthenticated per the vector. Not exploited per sources, no PoC found. Fix unknown; recheck OpenText/NetIQ support portal (KM articles) and the AAF 6.6.x release notes. Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}