Endpoint credential minting (insecure default allow-list)
Impact
OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.x, 6.5.0.0 through 6.5.0.x, and 6.6.0.0 through 6.6.1.0 have an insecure default vulnerability, allowing excessive allocation. A secure configuration requires not allowing creation of unauthenticated endpoints or only allowing it from trusted networks.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
OpenText · OpenText
Advanced Authentication Server
3 ranges
OpenText · OpenText
Advanced Authentication Server
Compare with this publisher’s ranges. This does not inspect your installation.
affected
6.4.0.0 → through 6.4.3.x
semver versions
From 6.6.2.0: unaffected
Source order retained; this version scheme requires manual review.
6.5.0.0 → through 6.5.0.x
semver versions
From 6.6.2.0: unaffected
Source order retained; this version scheme requires manual review.
6.6.0.0 → through 6.6.1.0
semver versions
From 6.6.2.0: unaffected
Source order retained; this version scheme requires manual review.
Other versions: unaffected
Original source description
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.
This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.
The fix for this is issue is to create a secure configuration. The 6.6.2.0 release has a best practice entry if the configuration is unsecure.
A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints. If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.
To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks. An empty whitelist will allow all networks to create/recreate endpoints.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-112255View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
OpenText · platform conditions
Any condition may hold
Any condition may hold
Vulnerable product
cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*From (inclusive): 6.4.0.0
Through (inclusive): 6.4.3.x
Vulnerable product
cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*From (inclusive): 6.5.0.0
Through (inclusive): 6.5.0.x
Vulnerable product
cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*From (inclusive): 6.6.0.0
Through (inclusive): 6.6.1.0
Original applicability statements
[
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.0.0",
"versionEndIncluding": "6.4.3.x"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.0.0",
"versionEndIncluding": "6.5.0.x"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.0.0",
"versionEndIncluding": "6.6.1.0"
}
]
}
]
}
]Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.