CVE-2026-126240 · Vendor
NO FIX YET · SEE WHAT TO DO
FortiAuthenticator builds an LDAP query from unsanitized input, so an authenticated attacker can alter the query. The sources say this can bypass authentication, but only when the upstream identity provider is malicious or compromised, or when the IdP lets users control the NameID or username attribute.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running Fortinet FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 that use SAML or an upstream identity provider. Exposure depends on the IdP configuration: the sources say exploitation requires a malicious or compromised upstream IdP, or an IdP that lets users control the NameID or the username attribute. Deployments with a trusted IdP and locked-down attribute mapping are less exposed.
Not affected if fortiauthenticator-outside-listed-ranges, locked-nameid-mapping, trusted-idp-only
Who cares fortiauthenticator, ldap, saml, sso
get system status on the applianceA improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.