CVE-2025-54973: Race condion in FortiCloud SSO SAML authentication
A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in FortiAnalyzer may allow an attacker to attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests.
Other sources
A concurrent execution using shared resource with improper synchronization ('Race Condition') vulnerability [CWE-362] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10 and before 7.0.13 allows an attacker to attempt to win a race condition to bypass the FortiCloud SSO authorization via crafted FortiCloud SSO requests.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54973?
CVE-2025-54973 has a high severity rating due to its potential to bypass FortiCloud SSO authorization.
How do I fix CVE-2025-54973?
To mitigate CVE-2025-54973, upgrade FortiAnalyzer to version 7.6.3 or later.
Which versions of FortiAnalyzer are affected by CVE-2025-54973?
CVE-2025-54973 affects FortiAnalyzer versions between 7.0.9 and 7.6.2.
Can CVE-2025-54973 be exploited remotely?
Yes, CVE-2025-54973 can be exploited remotely via crafted FortiCloud SSO requests.
What could be the impact of CVE-2025-54973 if exploited?
Exploitation of CVE-2025-54973 may allow unauthorized access by bypassing SSO authorization.