Advanced Authentication Server CVE-2026-112255

Exploitable only when the server is configured to allow creation/recreation of Unauthenticated Endpoints with an empty whitelist, which the vendor states permits all networks to create/recreate endpoints. This is the AT:P attack requirement in the CVSS 4.0 vector. Exploitation is eliminated by the documented secure configuration: disallow Unauthenticated Endpoint creation entirely, or, if required, specify trusted networks via a non-empty whitelist. Limiting factors: the insecure state is a configuration choice rather than the shipped behavior the vendor now recommends, the recorded impact is only low confidentiality (no integrity or availability), and upgrading to 6.6.2.0 surfaces a best-practice warning when the configuration is unsecure.

This is a low-priority issue, and the available signals are consistent on that. The vendor-supplied CVSS 4.0 base score is 2.9 (Low), the vuln.today Decision label is 'monitor', and there is no CISA KEV listing, so there is no evidence of active exploitation. The impact is narrow: the 4.0 vector sets VC:L and VI:N/VA:N, meaning only low confidentiality impact and no integrity or availability impact recorded, despite the CWE being Excessive Allocation (CWE-1188, insecure default). The vector also carries AT:P (an attack requirement must be met) and the mitigation text confirms the flaw only manifests under a specific insecure configuration (unauthenticated endpoint creation allowed with an empty whitelist), so this is not a default-config, no-conditions remote bug. One conflicting signal to flag explicitly: the CVSS 4.0 vector contains E:P (proof-of-concept exploit maturity), yet no PoC or exploit reference appears anywhere in the provided sources - the four references are all vendor documentation pages. EPSS is not provided, so widespread-exploitation probability cannot be assessed. Net: a genuine but low-severity, configuration-dependent misconfiguration risk, not an urgent patch item.

An OpenText Advanced Authentication Server is deployed with the insecure configuration that permits creation/recreation of Unauthenticated Endpoints from any network (an empty whitelist allows all networks). A remote attacker who can reach the server abuses this to create or recreate endpoints, causing excessive resource allocation and a limited information exposure. No PoC or exploit reference is included in the supplied sources, though the vendor CVSS 4.0 vector asserts E:P (proof-of-concept maturity).