CVE-2026-112255

The record

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from 6.6.0.0 through 6.6.1.0. The fix for this is issue is to create a secure configuration.  The 6.6.2.0 release has a best practice entry if the configuration is unsecure. A secure configuration is to NOT allow creation/recreation of Unauthenticated Endpoints.  If creation/recreation of Unauthenticated Endpoints is required, you should only allow it from trusted networks.   To remedy this issue, change your configuration to NOT allow creation/recreation of Unauthenticated Endpoints. If you require Unauthenticated Endpoints, you MUST change your configuration to use a non-empty whitelist to specify the trusted networks.  An empty whitelist will allow all networks to create/recreate endpoints.

Affected packages

Related vulnerabilities

• CVE-2026-116247 When a server in pgAdmin 4 had no password file, client certificate or client key… CWE-1188
• CVE-2026-116244 When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials… CWE-1188
• CVE-2026-116242 pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither… CWE-1188
• CVE-2026-118691 xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the… CWE-1188
• CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts… CWE-1188
• CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled… CWE-1188
• CVE-2026-116672 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-1188
• CVE-2026-25784 Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! CWE-1188