Advanced Authentication Server
Monthly
ACL bypass in OpenText Advanced Authentication Server 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 allows remote unauthenticated attackers to reach functionality that is not properly constrained by ACLs, with high confidentiality and integrity impact. The flaw is CWE-349 (acceptance of extraneous untrusted data with trusted data) and is rated 9.2 with an act_now priority. No KEV-listed active exploitation is reported; the CVSS 4.0 vector carries E:P proof-of-concept maturity, but working exploit code is not confirmed in the provided sources.
An insecure default in OpenText Advanced Authentication Server lets a deployment run with an empty trusted-network whitelist for Unauthenticated Endpoints, so any network can create or recreate those endpoints, causing excessive resource allocation and limited information exposure. Affected branches are 6.4.0.0 through 6.4.3.x, 6.5.0.0 through 6.5.0.x, and 6.6.0.0 through 6.6.1.0, and the weakness only materialises when administrators have left that configuration in its permissive state (the AT:P attack requirement in the CVSS 4.0 vector). Recorded impact is low confidentiality only, with no integrity or availability effect, and the assigned CVSS 4.0 base score of 2.9 with an E:P exploit-maturity rating means a public proof-of-concept reference is recorded but is not verified as working exploit code; there is no KEV entry, and the vendor-reported issue carries a monitor priority. The vendor's own remediation framing confirms the fix is a secure configuration plus the 6.6.2.0 release that flags unsecure settings.
ACL bypass in OpenText Advanced Authentication Server 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 allows remote unauthenticated attackers to reach functionality that is not properly constrained by ACLs, with high confidentiality and integrity impact. The flaw is CWE-349 (acceptance of extraneous untrusted data with trusted data) and is rated 9.2 with an act_now priority. No KEV-listed active exploitation is reported; the CVSS 4.0 vector carries E:P proof-of-concept maturity, but working exploit code is not confirmed in the provided sources.
An insecure default in OpenText Advanced Authentication Server lets a deployment run with an empty trusted-network whitelist for Unauthenticated Endpoints, so any network can create or recreate those endpoints, causing excessive resource allocation and limited information exposure. Affected branches are 6.4.0.0 through 6.4.3.x, 6.5.0.0 through 6.5.0.x, and 6.6.0.0 through 6.6.1.0, and the weakness only materialises when administrators have left that configuration in its permissive state (the AT:P attack requirement in the CVSS 4.0 vector). Recorded impact is low confidentiality only, with no integrity or availability effect, and the assigned CVSS 4.0 base score of 2.9 with an E:P exploit-maturity rating means a public proof-of-concept reference is recorded but is not verified as working exploit code; there is no KEV entry, and the vendor-reported issue carries a monitor priority. The vendor's own remediation framing confirms the fix is a secure configuration plus the 6.6.2.0 release that flags unsecure settings.