Fortinet Fortiauthenticator

FortiAuthenticator <=6.6.10 & <=8.0.3 Hardcoded Password Bypass
CVE-2026-126257 9 - Critical - November 11, 2026

A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.

Use of Hard-coded Password

FortiAuthenticator 6.6.08.0.3 Open Redirect (Unauthenticated)
CVE-2026-121526 5.8 - Medium - November 11, 2026

A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.

Open Redirect

FortiAuthenticator 6.6.0-8.0.3 Auth SQL Injection
CVE-2026-126252 8.3 - High - November 11, 2026

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized code or commands via http requests

SQL Injection

FortiAuthenticator authz bypass (6.6.06.6.10, 8.0.08.0.3)
CVE-2026-126251 9.1 - Critical - November 11, 2026

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.

AuthZ

FortiAuthenticator 6.6.06.6.10 & 8.0.08.0.3 Authz Bypass DoS
CVE-2026-126250 8.2 - High - November 11, 2026

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to cause a denial of service via HTTP requests.

AuthZ

FortiAuthenticator 6.6.x-8.0.x Insufficiently Protected Credentials via HTTPS (CVE-2026-126248)
CVE-2026-126248 7.5 - High - November 11, 2026

A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests.

Insufficiently Protected Credentials

FortiAuthenticator <=8.0.3 PrivEsc via Improper Privilege Management
CVE-2026-126249 7.2 - High - November 11, 2026

A improper privilege management vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to escalate privileges.

Improper Privilege Management

FortiAuthenticator <=8.0.3 & <=6.6.10 External Format String RCE
CVE-2026-126247 7.2 - High - November 11, 2026

A use of externally-controlled format string vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated privileged attacker to execute unauthorized code or commands via http requests.

Use of Externally-Controlled Format String

FortiAuthenticator 6.6.0-8.0.3 Null Ptr Deref DoS (CVE-2026-126246)
CVE-2026-126246 7.5 - High - November 11, 2026

A null pointer dereference vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform a denial of service attack via http requests.

NULL Pointer Dereference

FortiAuthenticator 6.6.08.0.3 OOB Write via HTTP Leads to Code Exec
CVE-2026-126245 8.1 - High - November 11, 2026

A out-of-bounds write vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to execute unauthorized code or commands via http requests, should the attacker be able to defeat ASLR protections.

Memory Corruption

FortiAuthenticator 6.68.0 Resource Exhaustion DoS
CVE-2026-126244 7.5 - High - November 11, 2026

A allocation of resources without limits or throttling vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS).

Allocation of Resources Without Limits or Throttling

FortiAuthenticator 6.6.0-8.0.3 Stack Buffer Overflow in FSSO (CVE-2026-126239)
CVE-2026-126239 7.5 - High - November 11, 2026

A stack-based buffer overflow vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to crash the FSSO subsystem via crafted http requests

Stack Overflow

FortiAuthenticator 6.6.06.6.10, 8.0.08.0.3 SQLi
CVE-2026-126241 8.8 - High - November 11, 2026

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to execute unauthorized SQL commands on the underlying database.

SQL Injection

FortiAuthenticator LDAP Injection Auth Bypass in 6.6.0-6.6.10 & 8.0.0-8.0.3
CVE-2026-126240 8.2 - High - November 11, 2026

A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).

LDAP Injection

FortiAuthenticator authz bypass in 6.6.0-6.6.10 & 8.0.0-8.0.3
CVE-2026-126238 8.6 - High - November 11, 2026

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass authorization checks and gain unauthorized access to restricted functionality.

AuthZ

Fortinet FortiAuthenticator 6.6.0-8.0.3 Infinite Loop DoS via TCP
CVE-2026-126237 7.5 - High - November 11, 2026

A loop with unreachable exit condition ('infinite loop') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to cause a denial of service via crafted TCP requests.

Infinite Loop

FortiAuthenticator 6.6.06.6.10/8.0.08.0.3 Auth Bypass (Authz) Vulnerability
CVE-2026-126243 7.2 - High - November 11, 2026

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.

AuthZ

Fortinet FortiAuthenticator auth bypass in 6.6.06.6.10 & 8.0.08.0.3
CVE-2026-126242 7.4 - High - November 11, 2026

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.

AuthZ

FortiAuthenticator OOB Read 6.5-6.6.2 Remote Unauth Leak
CVE-2025-53379 7 - High - July 14, 2026

A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.

Out-of-bounds Read

FortiAuthenticator 8.0.2 RCE via Improper Access Control
CVE-2026-44277 9.1 - Critical - May 12, 2026

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6, FortiAuthenticator 6.4.0 through 6.4.10 may allow attacker to execute unauthorized code or commands via crafted requests.

Authorization

FortiAuthenticator 6.3-6.6.x: Auth Bypass via Unprotected File Upload
CVE-2026-21743 6.8 - Medium - February 10, 2026

A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.

AuthZ

FortiAuthenticator 6.36.6 Forced Browsing Log Retrieval
CVE-2025-57823 2.6 - Low - December 09, 2025

A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints

forced browsing

Improper Acc. Control in FortiAuth 6.6.0-6.6.4 & 6.5-6.3 Leaks Admin Creds
CVE-2025-59923 2.6 - Low - December 09, 2025

An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.

Authorization

Fortinet FortiManager/<others> <=7.4.3 Cache Poison via External Host Header
CVE-2022-23439 4.1 - Medium - January 22, 2025

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitrary webserver

Externally Controlled Reference to a Resource in Another Sphere

FortiAuthenticator <6.6 Open Redirect via crafted URL
CVE-2024-23664 6.1 - Medium - June 03, 2024

A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an arbitrary website via a crafted URL.

Open Redirect

FortiGate & FortiAuthenticator 6.x Clear-Text Storage of Private Keys (CWE-312)
CVE-2022-22302 3.3 - Low - July 11, 2023

A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.

Cleartext Storage of Sensitive Information

FortiAuthenticator XSS via reset-password page v6.4.0-6.4.4,6.3.0-6.3.3,6.2,6.1
CVE-2022-35850 6.1 - Medium - April 11, 2023

An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.

XSS

Fortinet FortiAuthenticator 6.4.x Improper Authentication Attempt Restriction
CVE-2023-26208 5.3 - Medium - March 09, 2023

A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form.

Improper Restriction of Excessive Authentication Attempts

An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may
CVE-2021-26116 8.8 - High - April 06, 2022

An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.

Shell injection

An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may
CVE-2021-36177 4.3 - Medium - February 02, 2022

An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database.

A improper authentication in Fortinet FortiAuthenticator version 6.4.0
CVE-2021-43068 8.1 - High - December 09, 2021

A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal.

authentification

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1
CVE-2021-43067 6.5 - Medium - December 08, 2021

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted HTTP requests.

Information Disclosure

An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may
CVE-2021-22124 7.5 - High - August 04, 2021

An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters.

Resource Exhaustion

Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may
CVE-2021-24005 7.5 - High - July 06, 2021

Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key.

Use of Hard-coded Credentials

An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may
CVE-2019-16154 6.1 - Medium - January 07, 2020

An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page.

XSS

A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page
CVE-2018-9186 6.1 - Medium - May 31, 2018

A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header.

XSS