Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112255— Endpoint credential minting (insecure default allow-list)

Quick assessment

Affected
OpenText Advanced Authentication Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenText Advanced Authentication Server 中存在“使用不安全的默认值初始化资源”的漏洞，可能导致资源过度分配。 该问题影响以下版本的 Advanced Authentication Server： 6.4.0.0 至 6.4.3.x 6.5.0.0 至 6.5.0.x 6.6.0.0 至 6.6.1.0 修复此问题的方法是实施安全配置。在 6.6.2.0 版本中，若检测到配置不安全，系统会提供最佳实践建议。 安全配置要求：禁止创建或重新创建未认证端点（Unauthenticat

CVSS 2.9 · Low EPSS 0.47% · P41

Affected Version Matrix 3

VendorProduct Version RangeStatus
OpenText Advanced Authentication Server 6.4.0.0≤ 6.4.3.x affected
6.5.0.0≤ 6.5.0.x affected
6.6.0.0≤ 6.6.1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-112255

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Endpoint credential minting (insecure default allow-list)
Source: CVE Program / CVE List V5
Vulnerability Description
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure. A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.   To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:L/U:Amber
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的默认资源初始化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OpenText Advanced Authentication Server 6.4.0.0 ~ 6.4.3.x -

II. Public POCs for CVE-2026-112255

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112255

请登录查看更多情报信息。

Vendor Pages for CVE-2026-112255 (4)

IV. Related Vulnerabilities

Same product: Advanced Authentication Server
Same vendor: OpenText
Same weakness: CWE-1188