CVE-2026-121526: Medium severity vulnerability

Published Nov 11, 2026

Updated

A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 6.6.11
Upgrade
Upgrade Fortinet FortiAuthenticator to a version that resolves this vulnerability.
Fixed in 8.0.4

Event History

Nov 11, 2026

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.

Does exploitation require authentication or user interaction?

An attacker does not need to authenticate, but exploitation requires a user to interact with the crafted HTTP request or resulting redirect.

What can an attacker do with this issue?

An attacker can cause a redirect to an untrusted site using crafted HTTP requests. The listed impacts include low confidentiality and integrity impact, with no availability impact.