Login Request a demo
Critical severity · published Oct 29, 2026
CVE-2026-112256
Logon bypass (trust of attacker-controlled completed-methods list)
New
9.2
CVSS
–
EPSS
No
On KEV
Description
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Advanced Authentication Server · OpenText
6.4.0.0 through 6.4.3.8; 6.5.0.0 through 6.5.0.10; 6.6.0.0 through 6.6.1.0 · source: vendor
Affected product
AA
Advanced Authentication Server
OpenText
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112256
release-notes
https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662
release-notes
https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662
docs.microfocus.com
https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439
docs.microfocus.com
https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011
More from Advanced Authentication Server
2.9
CVE-2026-112255
Endpoint credential minting (insecure default allow-list)