Skip to content
OpenAdvisories
Critical · 9.2 CVE-2026-112256 EUVD-2026-113003GHSA-rqjf-xhwg-fh67

Logon bypass (trust of attacker-controlled completed-methods list)

Published Oct 29, 2026 · Updated Nov 5, 2026 · Assigned by OpenText

Description

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.

Affected products

VendorProductAffectedFixed
OpenText Advanced Authentication Server 6.4.0.0 – ≤ 6.4.3.8, 6.5.0.0 – ≤ 6.5.0.10, 6.6.0.0 – ≤ 6.6.1.0 —

References