opentext Advanced Authentication Server vulnerabilities

Latest opentext Advanced Authentication Server CVEs

Newest publication first

1. CVE-2026-112256 Logon bypass (trust of attacker-controlled completed-methods list)

   Published 2026-10-29

   Critical·CVSS 9.2 EPSS 0.25%

   Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 throug...

2. CVE-2026-112255 Endpoint credential minting (insecure default allow-list)

   Published 2026-10-29

   Low·CVSS 2.9 EPSS 0.47%

   Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.