{"id":"CVE-2026-112255","aliases":["EUVD-2026-113002","GHSA-m3px-g696-rxgm"],"status":"published","title":"Endpoint credential minting (insecure default allow-list)","description":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.\n\n\n\nThe fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.\n\n\n\nA secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  \n\n\n\nTo remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.","severity":{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:L/U:Amber","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00469,"percentile":0.40903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1188"],"published":"2026-10-29T15:30:55Z","modified":"2026-11-05T20:51:35Z","products":[{"vendor":"opentext","product":"advanced authentication server"}],"references":[{"url":"https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662"},{"url":"https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662"},{"url":"https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439"},{"url":"https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112255"},{"url":"https://github.com/advisories/GHSA-m3px-g696-rxgm"}],"sources":{"cve":[{"id":"CVE-2026-112255","title":"Endpoint credential minting (insecure default allow-list)","description":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.\n\n\n\nThe fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.\n\n\n\nA secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  \n\n\n\nTo remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.","status":"published","published":"2026-10-29T15:30:55.825Z","modified":"2026-11-05T20:51:35.915Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:L/U:Amber","level":"low","assessor":"cna"}],"cwes":["CWE-1188"],"updated_at":"2026-11-05T21:25:05.248795Z"}],"euvd":[{"id":"EUVD-2026-113002","description":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.\n\n\n\nThe fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.\n\n\n\nA secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  \n\n\n\nTo remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.","status":"published","published":"2026-10-29T15:30:55Z","modified":"2026-11-05T20:51:35Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:L/U:Amber","level":"low"}],"updated_at":"2026-11-05T22:02:10.222428Z"}],"ghsa":[{"id":"GHSA-m3px-g696-rxgm","title":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced...","description":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.\n\n\n\nThe fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.\n\n\n\nA secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  \n\n\n\nTo remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.","status":"published","published":"2026-10-29T18:30:53Z","modified":"2026-10-29T18:30:54Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber","level":"low"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:14:39.34849Z"}],"nvd":[{"id":"CVE-2026-112255","description":"Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.\n\nThis issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.\n\n\n\nThe fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.\n\n\n\nA secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  \n\n\n\nTo remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.","status":"published","published":"2026-10-29T16:17:58.19Z","modified":"2026-11-05T21:18:36.343Z","cvss":[{"version":"4.0","score":2.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber","level":"low","assessor":"secondary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-05T23:57:22.428307Z"}]}}