CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list)

CriticalCVSS 9.2 EPSS 0.25%

Published: 2026-10-29 17:31
Updated: 2026-11-06 00:17
Exploit status: No public exploit known

Description

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.

Affected products

Product	Affected versions	Fixed in
opentext Advanced Authentication Server	>= 6.4.0.0, < 6.4.3.9	6.4.3.9
opentext Advanced Authentication Server	>= 6.5.0.0, < 6.5.0.11	6.5.0.11
opentext Advanced Authentication Server	>= 6.6.0.0, < 6.6.2.0	6.6.2.0

References

CVSS v4.0

9.2 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/AU:Y/V:C/RE:M/U:Red

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: None
Exploit Maturity: POC
AU: Y
V: C
RE: M
U: Red

All scores (2)

v4.0 9.2 · opentext
v4.0 9.2 · security@opentext.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.25% (percentile 15.9)
CWE: CWE-349 Acceptance of extraneous untrusted data with trusted data

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.