{"id":"CVE-2026-121526","kind":"vulnerability","aliases":["CVE-2026-121526"],"related":[],"title":"Fortinet FortiAuthenticator: open redirect lets attackers send users to malicious sites","description":"A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 can be tricked into redirecting users to an attacker-chosen site via crafted HTTP requests. An unauthenticated attacker can use this for phishing or credential theft against users who follow the redirect.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortiauthenticator","fortinet","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed FortiAuthenticator version in the admin interface; versions `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10` are listed as affected.","fix":"- Move to a fixed FortiAuthenticator release; the sources do not name the fixed version.","status":"open","published_at":"2026-11-11T22:17:10+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","triaged_at":"2026-11-11T22:34:04+00:00","updated_at":"2026-11-11T22:34:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:34:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed FortiAuthenticator release; the sources do not name the fixed version.","reach":"internet","title":"Fortinet FortiAuthenticator: open redirect lets attackers send users to malicious sites","impact":"low","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 can be tricked into redirecting users to an attacker-chosen site via crafted HTTP requests. An unauthenticated attacker can use this for phishing or credential theft against users who follow the redirect.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Users are redirected to attacker sites for phishing or credential theft.","analyst_note":"Confirm the fixed FortiAuthenticator versions and any Fortinet PSIRT advisory from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121526.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface; versions `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10` are listed as affected.\n- unknown for any other check, as the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"FortiAuthenticator appliances running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are affected, and the flaw is reachable without logging in. Sources do not say whether specific configurations or features change exposure, so unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000778,"input_tokens":4574,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121526':14A,17A '-2026':13A,16A '6.6.0':29B,81C '6.6.10':31B,83C '8.0.0':25B,77C '8.0.3':27B,79C 'allow':85C 'attack':6A,41B,50B,88C,94C 'attacker-chosen':40B 'chosen':42B 'craft':45B,96C 'credenti':57B 'cve':12A,15A 'follow':62B 'fortiauthent':2A,18B,24B,76C,80C 'fortinet':1A,19B,75C 'host':23B 'http':46B,97C 'infrastructur':20B 'let':5A 'malici':10A 'may':84C 'open':3A,71C,92C 'perform':90C 'phish':55B 'redirect':4A,36B,64B,67C,72C,93C 'request':47B,98C 'self':22B 'self-host':21B 'send':7A 'site':11A,43B,70C 'theft':58B 'trick':34B 'unauthent':49B,87C 'untrust':69C 'url':66C 'use':52B 'user':8A,37B,60B 'via':44B,95C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"FortiAuthenticator appliances running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are affected, and the flaw is reachable without logging in. Sources do not say whether specific configurations or features change exposure, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortiauthenticator","fortinet","infrastructure","medium","selfhosted"],"campaign_type":null,"search_a":"'-121526':14A,17A '-2026':13A,16A 'attack':6A 'cve':12A,15A 'fortiauthent':2A 'fortinet':1A 'let':5A 'malici':10A 'open':3A 'redirect':4A 'send':7A 'site':11A 'user':8A","search_b":"'6.6.0':29B '6.6.10':31B '8.0.0':25B '8.0.3':27B 'attack':41B,50B 'attacker-chosen':40B 'chosen':42B 'craft':45B 'credenti':57B 'follow':62B 'fortiauthent':18B,24B 'fortinet':19B 'host':23B 'http':46B 'infrastructur':20B 'phish':55B 'redirect':36B,64B 'request':47B 'self':22B 'self-host':21B 'site':43B 'theft':58B 'trick':34B 'unauthent':49B 'use':52B 'user':37B,60B 'via':44B","search_c":"'6.6.0':81C '6.6.10':83C '8.0.0':77C '8.0.3':79C 'allow':85C 'attack':88C,94C 'craft':96C 'fortiauthent':76C,80C 'fortinet':75C 'http':97C 'may':84C 'open':71C,92C 'perform':90C 'redirect':67C,72C,93C 'request':98C 'site':70C 'unauthent':87C 'untrust':69C 'url':66C 'via':95C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121526","severity":null,"published_at":"2026-11-11T22:17:10+00:00","modified_at":"2026-11-11T22:17:10+00:00","first_seen_at":"2026-11-11T22:29:27+00:00","fetched_at":"2026-11-11T22:29:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}