CVE-2026-112256

CriticalCVSS 9.2/10Last modified Nov 5, 2026

Description

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.

Metrics

CVSS 4.0 9.2/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:M/U:Red

Weakness enumeration

CWE-349

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
OpenTextAdvanced Authentication Server>= 6.4.0.0, <= 6.4.3.8; >= 6.5.0.0, <= 6.5.0.10; >= 6.6.0.0, <= 6.6.1.0

References

Timeline

Published
Oct 29, 2026
Last modified
Nov 5, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1122577.8A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verifCVE-2026-1122587.8A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed vCVE-2026-1122595.5A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during stringCVE-2026-112266.5Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a uCVE-2026-1122607.1A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacenCVE-2026-1122617.8A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main CVE-2026-1122627.1RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary servCVE-2026-1122637.8Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through impCVE-2026-1122647.8BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions bCVE-2026-1122656.5LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged LarCVE-2026-1122665.9SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requestsCVE-2026-1122676.5SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated
CVE-2026-112256: Critical severity, CVSS 9.2 | Vulnix