CVE-2026-121526 · Infrastructure
NO FIX YET · SEE WHAT TO DO
FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 can be tricked into redirecting users to an attacker-chosen site via crafted HTTP requests. An unauthenticated attacker can use this for phishing or credential theft against users who follow the redirect.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
FortiAuthenticator appliances running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are affected, and the flaw is reachable without logging in. Sources do not say whether specific configurations or features change exposure, so unknown.
Not affected if unknown
Who cares fortiauthenticator, fortinet, self-hosted
8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 are listed as affected.A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.