Logon bypass (trust of attacker-controlled completed-methods list)
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
Summary
OpenText Advanced Authentication Server is affected by this vulnerability. An attacker could potentially bypass the logon process and access functionality that should be restricted, because the server trusts data supplied by the client that it should not.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8, from 6.5.0.0 through 6.5.0.10, and from 6.6.0.0 through 6.6.1.0.
Affected versions
- OpenText Advanced Authentication Server
From 6.4.0.0 · through 6.4.3.8; From 6.5.0.0 · through 6.5.0.10; From 6.6.0.0 · through 6.6.1.0