CVE-2026-126242: High severity vulnerability
A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.6.11 - Upgrade
Upgrade
FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 8.0.4 - Upgrade
Upgrade
FortiAuthenticatorto a version that resolves this vulnerability.Fixed in 6.5.8
Event History
Frequently Asked Questions
What must an attacker obtain to fully impersonate a user?
Full impersonation requires the attacker to obtain a pre-required ID and data through other means. The vulnerability may otherwise allow authentication bypass and unauthorized access.
Which FortiAuthenticator releases are affected?
Affected releases are FortiAuthenticator 8.0.0 through 8.0.3 and FortiAuthenticator 6.6.0 through 6.6.10.
Does exploitation require an authenticated account or user interaction?
No. The listed metrics indicate no privileges are required and no user interaction is required, although attack complexity is high.