CVE-2025-8616— Malicious browser plugins may cause Authentication replay attack vulnerability to bypass authentication in OpenText Advanced Authentication
Quick assessment
Affected
OpenText Advanced Authentication
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenText Advanced Authentication是加拿大OpenText公司的一个高级身份验证框架。 OpenText Advanced Authentication 6.5.0及之前版本存在安全漏洞，该漏洞源于恶意浏览器插件可记录和重放用户身份验证过程，绕过身份验证。
Possible ATT&CK Techniques 1 AI
T1621 · Multi-Factor Authentication Request Generation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-8616
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Malicious browser plugins may cause Authentication replay attack vulnerability to bypass authentication in OpenText Advanced Authentication
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Authentication. This issue affects Advanced Authentication on or before 6.5.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
OpenText Advanced Authentication 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenText Advanced Authentication是加拿大OpenText公司的一个高级身份验证框架。 OpenText Advanced Authentication 6.5.0及之前版本存在安全漏洞，该漏洞源于恶意浏览器插件可记录和重放用户身份验证过程，绕过身份验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenText | Advanced Authentication | 6.5.0 ~ = < | - |
|
II. Public POCs for CVE-2025-8616
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-8616
请登录查看更多情报信息。
Other References for CVE-2025-8616 (1)
IV. Related Vulnerabilities
Same vendor: OpenText
-
CVE-2026-12559
Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice -
CVE-2026-13202
HTML Injection in OTDS Swagger UI -
CVE-2026-11877
Missing Authorization Vulnerability in OpenText Access Manag -
CVE-2026-11878
Reflected Cross-Site Scripting vulnerability in OpenText Acc -
CVE-2026-2123
Privilege escalation vulnerability in Operations Agent
Same weakness: CWE-294
-
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at -
CVE-2026-103655
MISP TOTP Code Replay Allows Duplicate Authentication Within -
CVE-2026-82379
Apache Roller: WSSE digest authentication headers can be rep -
CVE-2026-100834
http4k before 6.48.0.0 Digest Authentication Replay Protecti -
CVE-2026-77967
Botslab G980H Dashcams Authentication Bypass by Capture-repl
V. Comments for CVE-2025-8616
No comments yet