{"id":"CVE-2026-112256","aliases":[],"cve":{"records":[{"id":"CVE-2026-112256","source":"OpenText","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-19T12:58:32.736Z","published":"2026-10-29T15:31:18.768Z","modified":"2026-10-29T15:31:18.768Z"}],"publishers":[{"name":"OpenText","role":"CNA","organizationId":"f81092c5-7f14-476d-80dc-24857f90be84","modified":"2026-10-29T15:31:18.768Z"}],"references":[{"url":"https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662","tags":["release-notes"],"source":"OpenText"},{"url":"https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662","tags":["release-notes"],"source":"OpenText"},{"url":"https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439","tags":[],"source":"OpenText"},{"url":"https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011","tags":[],"source":"OpenText"}],"weaknesses":[{"id":"CWE-349","description":"CWE-349 Acceptance of extraneous untrusted data with trusted data","source":"OpenText"}],"applicability":[{"source":"OpenText","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.0.0","versionEndIncluding":"6.4.3.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.0.0","versionEndIncluding":"6.5.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:a:opentext:advanced_authentication_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.0.0","versionEndIncluding":"6.6.1.0"}]}]}]}],"prioritization":[]},"title":"Logon bypass (trust of attacker-controlled completed-methods list)","titleSource":"OpenText","descriptionSource":"OpenText","description":"Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.","score":9.2,"severity":"critical","published":"2026-10-29T15:31:18.768Z","modified":"2026-10-29T15:31:18.768Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"OpenText","name":"Advanced Authentication Server","platforms":[],"versions":[{"version":"6.4.0.0","status":"affected","lessThanOrEqual":"6.4.3.8","versionType":"semver","changes":[{"at":"6.4.3.9","status":"unaffected"}]},{"version":"6.5.0.0","status":"affected","lessThanOrEqual":"6.5.0.10","versionType":"semver","changes":[{"at":"6.5.0.11","status":"unaffected"}]},{"version":"6.6.0.0","status":"affected","lessThanOrEqual":"6.6.1.0","versionType":"semver","changes":[{"at":"6.6.2.0","status":"unaffected"}]}],"defaultStatus":"unaffected","cpes":[],"source":"OpenText","url":"https://www.cve.org/CVERecord?id=CVE-2026-112256"}],"remediation":[],"references":["https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662","https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662","https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439","https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011"],"sources":[{"name":"CVE","id":"CVE-2026-112256","modified":"2026-10-29T15:31:18.768Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112256"}],"assessments":[{"source":"OpenText","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/AU:Y/V:C/RE:M/U:Red","score":9.2}],"sourceAffected":[],"observedAt":"2026-10-29T16:10:53.542Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T16:45:31.827Z","attemptedAt":"2026-10-29T16:45:31.827Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T16:45:31.827Z","attemptedAt":"2026-10-29T16:45:31.827Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T16:45:31.827Z","attemptedAt":"2026-10-29T16:45:31.827Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T16:45:31.827Z","attemptedAt":"2026-10-29T16:45:31.827Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113003","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113003","modified":"Oct 29, 2026, 3:31:18 PM","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/AU:Y/V:C/RE:M/U:Red","checkedAt":"2026-10-29T16:45:31.827Z"},{"source":"NVD","id":"CVE-2026-112256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112256","modified":"2026-10-29T16:29:56.553","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:M/U:Red","checkedAt":"2026-10-29T16:45:31.827Z"}],"aiSummary":{"text":"OpenText Advanced Authentication Server versions 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 have an acceptance of extraneous untrusted data with trusted data vulnerability, allowing access to functionality not properly constrained by ACLs. An attacker may bypass logon controls.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:02:50.858Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112256"}]}}