CVE-2026-18159 · Vendor
NO FIX YET · SEE WHAT TO DO
OpenText Directory Services (OTDS) on Windows and Linux can be embedded in a hidden frame on another site, so a visitor can be tricked into clicking actions they did not intend. The attacker gets the user's authenticated actions in that session, not direct access to the server.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running OpenText Directory Services from 10.5 through 26.2 on Windows or Linux. The flaw needs a user to visit an attacker-controlled page while logged in, so exposure depends on whether OTDS pages can be framed. The sources do not say which configurations are safe.
Not affected if unknown
Who cares identity, linux, opentext, otds, windows
10.5 and 26.2X-Frame-Options or a frame-ancestors CSP directive (unknown if the sources name a specific setting)10.5 through 26.2: unknown, the sources do not name a fixed versionA vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.
This issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.