---
id: "CVE-2026-126240"
page: "https://infrastack.ai/live/CVE-2026-126240"
kind: "vulnerability"
aliases: ["CVE-2026-126240"]
title: "Fortinet FortiAuthenticator: LDAP injection lets an authenticated user bypass login"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["fortiauthenticator", "ldap", "saml", "sso", "vendor"]
not_affected_if: ["fortiauthenticator-outside-listed-ranges", "locked-nameid-mapping", "trusted-idp-only"]
published_at: "2026-11-11T22:17:23+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:31:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126240", "first_seen_at": "2026-11-11T22:29:32+00:00"}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: LDAP injection lets an authenticated user bypass login

Link for people: https://infrastack.ai/live/CVE-2026-126240 (this .md is for agents)

FortiAuthenticator builds an LDAP query from unsanitized input, so an authenticated attacker can alter the query. The sources say this can bypass authentication, but only when the upstream identity provider is malicious or compromised, or when the IdP lets users control the NameID or username attribute.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed FortiAuthenticator version with the admin interface or `get system status` on the appliance
- Review the SAML/IdP configuration to see whether users can control the NameID or the username attribute
- Check whether the upstream IdP is trusted and not compromised

## Fix

- FortiAuthenticator 8.0.0 through 8.0.3: fixed version unknown
- FortiAuthenticator 6.6.0 through 6.6.10: fixed version unknown

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126240

## From the sources

A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_