---
id: CVE-2026-112255
title: Endpoint credential minting (insecure default allow-list)
summary: >-
  Initialization of a resource with an insecure default vulnerability in
  OpenText Advanced Authentication Server allows Excessive Allocation.


  This issue affects Advanced Authentication Server: from 6.4.0.0 through
  6.4.3.x, from 6.5.0.0 th…
severity: low
cvss: 2.9
cvssVector: >-
  CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:L/U:Amber
cvssSource: cna
cwe:
  - CWE-1188
vendor: OpenText
product: Advanced Authentication Server
affected:
  - advanced_authentication_server >= 6.4.0.0 <= 6.4.3.x
  - advanced_authentication_server >= 6.5.0.0 <= 6.5.0.x
  - advanced_authentication_server >= 6.6.0.0 <= 6.6.1.0
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T15:30:55.825Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112255'
references:
  - url: 'https://docs.microfocus.com/doc/42/26.3.1/security-improvements-662'
  - url: 'https://docs.microfocus.com/doc/2582/26.3.1/security-improvements-662'
  - url: 'https://docs.microfocus.com/doc/42/6.4.3.9/security-improvements-6439'
  - url: 'https://docs.microfocus.com/doc/42/6.5.0.11/security-improvements-65011'
tags:
  - cve.org
epss: 0.00469
epssPercentile: 0.40594
ingestedAt: '2026-11-01T20:00:16.966Z'
---

## Overview

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation.

This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0.



The fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure.



A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.  



To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.

## Affected

- `advanced_authentication_server >= 6.4.0.0 <= 6.4.3.x`
- `advanced_authentication_server >= 6.5.0.0 <= 6.5.0.x`
- `advanced_authentication_server >= 6.6.0.0 <= 6.6.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.