{"id":"CVE-2026-126240","kind":"vulnerability","aliases":["CVE-2026-126240"],"related":[],"title":"Fortinet FortiAuthenticator: LDAP injection lets an authenticated user bypass login","description":"A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).","summary":"FortiAuthenticator builds an LDAP query from unsanitized input, so an authenticated attacker can alter the query. The sources say this can bypass authentication, but only when the upstream identity provider is malicious or compromised, or when the IdP lets users control the NameID or username attribute.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fortiauthenticator","ldap","saml","sso","vendor"],"not_affected_if":["fortiauthenticator-outside-listed-ranges","locked-nameid-mapping","trusted-idp-only"],"how_to_check":"- Confirm the installed FortiAuthenticator version with the admin interface or `get system status` on the appliance\n- Review the SAML/IdP configuration to see whether users can control the NameID or the username attribute\n- Check whether the upstream IdP is trusted and not compromised","fix":"- FortiAuthenticator 8.0.0 through 8.0.3: fixed version unknown\n- FortiAuthenticator 6.6.0 through 6.6.10: fixed version unknown","status":"open","published_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:31:37+00:00","updated_at":"2026-11-11T22:31:37+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-11T22:31:37Z","model":"claude-haiku-5-5","output":{"fix":"- FortiAuthenticator 8.0.0 through 8.0.3: fixed version unknown\n- FortiAuthenticator 6.6.0 through 6.6.10: fixed version unknown","reach":"network","title":"Fortinet FortiAuthenticator: LDAP injection lets an authenticated user bypass login","impact":"high","summary":"FortiAuthenticator builds an LDAP query from unsanitized input, so an authenticated attacker can alter the query. The sources say this can bypass authentication, but only when the upstream identity provider is malicious or compromised, or when the IdP lets users control the NameID or username attribute.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortiauthenticator","saml","ldap","sso"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authentication bypassed, attacker logs in as another user","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2026-126240 to confirm fixed versions and exact IdP preconditions; sources only list NVD.","how_to_check":"- Confirm the installed FortiAuthenticator version with the admin interface or `get system status` on the appliance\n- Review the SAML/IdP configuration to see whether users can control the NameID or the username attribute\n- Check whether the upstream IdP is trusted and not compromised","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fortiauthenticator-outside-listed-ranges","trusted-idp-only","locked-nameid-mapping"],"who_is_affected":"Organizations running Fortinet FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 that use SAML or an upstream identity provider. Exposure depends on the IdP configuration: the sources say exploitation requires a malicious or compromised upstream IdP, or an IdP that lets users control the NameID or the username attribute. Deployments with a trusted IdP and locked-down attribute mapping are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000837,"input_tokens":4615,"output_tokens":750,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126240':13A,16A '-2026':12A,15A '6.6.0':89C '6.6.10':91C '8.0.0':85C '8.0.3':87C 'allow':93C,113C 'alter':35B 'attack':33B,96C 'attribut':67B,123C 'authent':7A,32B,44B,95C,99C 'build':23B 'bypass':9A,43B,98C 'compromis':55B 'configur':111C 'control':62B,117C 'cve':11A,14A 'either':103C 'element':73C 'exploit':101C 'fortiauthent':2A,17B,22B,84C,88C 'fortinet':1A,83C 'ident':50B 'idp':59B,107C,110C 'improp':69C 'inject':4A,80C 'input':29B 'ldap':3A,18B,25B,77C,79C 'let':5A,60B 'login':10A 'malici':53B 'malicious/compromised':105C 'may':92C 'nameid':64B,119C 'neutral':70C 'provid':51B 'queri':26B,37B,78C 'requir':102C 'saml':19B,122C 'say':40B 'sourc':39B 'special':72C 'sso':20B 'success':100C 'unsanit':28B 'upstream':49B,106C 'use':74C,124C 'user':8A,61B,115C 'usernam':66B,127C 'vendor':21B 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Fortinet FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 that use SAML or an upstream identity provider. Exposure depends on the IdP configuration: the sources say exploitation requires a malicious or compromised upstream IdP, or an IdP that lets users control the NameID or the username attribute. Deployments with a trusted IdP and locked-down attribute mapping are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["fortiauthenticator","high","ldap","saml","sso","vendor"],"campaign_type":null,"search_a":"'-126240':13A,16A '-2026':12A,15A 'authent':7A 'bypass':9A 'cve':11A,14A 'fortiauthent':2A 'fortinet':1A 'inject':4A 'ldap':3A 'let':5A 'login':10A 'user':8A","search_b":"'alter':35B 'attack':33B 'attribut':67B 'authent':32B,44B 'build':23B 'bypass':43B 'compromis':55B 'control':62B 'fortiauthent':17B,22B 'ident':50B 'idp':59B 'input':29B 'ldap':18B,25B 'let':60B 'malici':53B 'nameid':64B 'provid':51B 'queri':26B,37B 'saml':19B 'say':40B 'sourc':39B 'sso':20B 'unsanit':28B 'upstream':49B 'user':61B 'usernam':66B 'vendor':21B","search_c":"'6.6.0':89C '6.6.10':91C '8.0.0':85C '8.0.3':87C 'allow':93C,113C 'attack':96C 'attribut':123C 'authent':95C,99C 'bypass':98C 'configur':111C 'control':117C 'either':103C 'element':73C 'exploit':101C 'fortiauthent':84C,88C 'fortinet':83C 'idp':107C,110C 'improp':69C 'inject':80C 'ldap':77C,79C 'malicious/compromised':105C 'may':92C 'nameid':119C 'neutral':70C 'queri':78C 'requir':102C 'saml':122C 'special':72C 'success':100C 'upstream':106C 'use':74C,124C 'user':115C 'usernam':127C 'vulner':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126240","severity":null,"published_at":"2026-11-11T22:17:23+00:00","modified_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}