{"id":"CVE-2026-18159","kind":"vulnerability","aliases":["CVE-2026-18159"],"related":[],"title":"OpenText Directory Services: clickjacking lets a page trick users into clicks","description":"A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking.\n\nThis issue affects OpenText Directory Services (OTDS): from 10.5 through 26.2.","summary":"OpenText Directory Services (OTDS) on Windows and Linux can be embedded in a hidden frame on another site, so a visitor can be tricked into clicking actions they did not intend. The attacker gets the user's authenticated actions in that session, not direct access to the server.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","linux","opentext","otds","vendor","windows"],"not_affected_if":["unknown"],"how_to_check":"- Confirm whether your deployment runs OpenText Directory Services between versions `10.5` and `26.2`\n- Check whether OTDS responses set frame-restriction headers such as `X-Frame-Options` or a `frame-ancestors` CSP directive (unknown if the sources name a specific setting)","fix":"- OpenText Directory Services `10.5` through `26.2`: unknown, the sources do not name a fixed version","status":"open","published_at":"2026-11-05T20:17:51+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","triaged_at":"2026-11-05T20:43:27+00:00","updated_at":"2026-11-05T20:43:27+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-05T20:43:27Z","model":"claude-haiku-5-5","output":{"fix":"- OpenText Directory Services `10.5` through `26.2`: unknown, the sources do not name a fixed version","reach":"internet","title":"OpenText Directory Services: clickjacking lets a page trick users into clicks","impact":"low","summary":"OpenText Directory Services (OTDS) on Windows and Linux can be embedded in a hidden frame on another site, so a visitor can be tricked into clicking actions they did not intend. The attacker gets the user's authenticated actions in that session, not direct access to the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["opentext","otds","identity","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Logged-in users are tricked into unintended clicks on OTDS","analyst_note":"Find the OpenText advisory for CVE-2026-18159 to confirm the fixed version and any header or setting that prevents framing.","how_to_check":"- Confirm whether your deployment runs OpenText Directory Services between versions `10.5` and `26.2`\n- Check whether OTDS responses set frame-restriction headers such as `X-Frame-Options` or a `frame-ancestors` CSP directive (unknown if the sources name a specific setting)","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running OpenText Directory Services from 10.5 through 26.2 on Windows or Linux. The flaw needs a user to visit an attacker-controlled page while logged in, so exposure depends on whether OTDS pages can be framed. The sources do not say which configurations are safe.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00073,"input_tokens":4206,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18159':14A,17A '-2026':13A,16A '10.5':94C '26.2':96C 'access':68B 'action':50B,62B 'affect':88C 'allow':84C 'anoth':40B 'attack':56B 'authent':61B 'click':11A,49B 'clickjack':4A,85C 'cve':12A,15A 'direct':67B 'directori':2A,25B,77C,90C 'embed':34B 'frame':38B 'get':57B 'hidden':37B 'ident':18B 'intend':54B 'issu':87C 'let':5A 'linux':19B,31B,83C 'opentext':1A,20B,24B,75C,76C,89C 'otd':21B,27B,79C,92C 'page':7A 'server':71B 'servic':3A,26B,78C,91C 'session':65B 'site':41B 'trick':8A,47B 'user':9A,59B 'vendor':22B 'visitor':44B 'vulner':73C 'window':23B,29B,81C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenText Directory Services from 10.5 through 26.2 on Windows or Linux. The flaw needs a user to visit an attacker-controlled page while logged in, so exposure depends on whether OTDS pages can be framed. The sources do not say which configurations are safe.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","linux","medium","opentext","otds","vendor","windows"],"campaign_type":null,"first_public_at":"2026-11-05T20:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@opentext.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18159","severity":null,"published_at":"2026-11-05T20:17:51+00:00","modified_at":"2026-11-05T20:17:51+00:00","first_seen_at":"2026-11-05T20:40:46+00:00","fetched_at":"2026-11-05T20:40:46+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}