{"id":"CVE-2026-126242","kind":"vulnerability","aliases":["CVE-2026-126242"],"related":[],"title":"Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 have an incorrect authorization flaw. An attacker can bypass authentication and gain unauthorized access, though full impersonation also requires identifiers and data obtained another way.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4"],"affected":">= 8.0.0, <= 8.0.3","ecosystem":"vendor"},{"name":"FortiAuthenticator 6.6","fixed":["6.6.11"],"affected":">= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["fortiauthenticator","fortinet","self-hosted","unauthenticated","vendor"],"not_affected_if":["unknown"],"how_to_check":"Check the FortiAuthenticator version in the admin GUI (or 'get system status' on the CLI). Affected: 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. Versions 8.0.4+ and 6.6.11+ are fixed. Fortinet lists the attack type as unauthenticated (API component), so treat any instance whose management/API is reachable as exposed.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. No virtual patch or workaround listed by Fortinet.","status":"open","published_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:33:13+00:00","updated_at":"2026-11-11T22:37:30+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:33:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 have an incorrect authorization flaw. An attacker can bypass authentication and gain unauthorized access, though full impersonation also requires identifiers and data obtained another way.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortinet","fortiauthenticator","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses authentication and gains unauthorized access","analyst_note":"Confirm the fixed versions and any vendor advisory for FortiAuthenticator; the NVD entry alone does not state a fix or the required setup.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface and compare it with `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are in the affected ranges. The sources do not say which deployment settings make an instance reachable by an attacker.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4593,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed versions and any vendor advisory for FortiAuthenticator; the NVD entry alone does not state a fix or the required setup.","search":"'-126242':11A,14A '-2026':10A,13A '6.6':17A '6.6.0':30B,69C '6.6.10':32B,71C '8.0.0':26B,65C '8.0.3':28B,67C 'access':46B,82C 'allow':73C 'also':50B 'anoth':56B 'attack':6A,39B,75C,88C 'authent':42B,78C 'author':3A,36B,60C 'bypass':7A,41B,77C 'cve':9A,12A 'data':54B,96C 'flaw':4A,37B 'fortiauthent':2A,18B,25B,64C,68C 'fortiauthenticator':15A,16A 'fortinet':1A,19B,63C 'full':48B,83C 'gain':44B,80C 'host':22B 'howev':85C 'id':94C 'identifi':52B 'imperson':49B,84C 'incorrect':35B,59C 'let':5A 'login':8A 'may':72C 'mean':99C 'obtain':55B,90C 'pre':92C 'pre-requir':91C 'requir':51B,86C,93C 'self':21B 'self-host':20B 'though':47B 'unauthent':23B 'unauthor':45B,81C 'vendor':24B 'via':97C 'vulner':61C 'way':57B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiAuthenticator 8.0.0-8.0.3 or 6.6.0-6.6.10. Fortinet describes an unauthenticated incorrect-authorization flaw in the API that can bypass authentication; full impersonation needs the attacker to already hold pre-required IDs and data obtained another way (hence the high attack complexity, CVSS 7.4). Fortinet does not name a required setting, so any instance on an affected version should be upgraded; instances on 8.0.4+/6.6.11+ can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:37:30Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-257","run_id":3623},"products":{"at":"2026-11-11T22:37:30Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-257","run_id":3623},"how_to_check":{"at":"2026-11-11T22:37:30Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-257","run_id":3623},"who_affected":{"at":"2026-11-11T22:37:30Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-257","run_id":3623}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["66","fortiauthenticator","fortiauthenticator66"],"ptokens":["fortiauthenticator"],"labels":["fortiauthenticator","fortinet","high","selfhosted","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-126242':11A,14A '-2026':10A,13A '6.6':17A 'attack':6A 'author':3A 'bypass':7A 'cve':9A,12A 'flaw':4A 'fortiauthent':2A 'fortiauthenticator':15A,16A 'fortinet':1A 'let':5A 'login':8A","search_b":"'6.6.0':30B '6.6.10':32B '8.0.0':26B '8.0.3':28B 'access':46B 'also':50B 'anoth':56B 'attack':39B 'authent':42B 'author':36B 'bypass':41B 'data':54B 'flaw':37B 'fortiauthent':18B,25B 'fortinet':19B 'full':48B 'gain':44B 'host':22B 'identifi':52B 'imperson':49B 'incorrect':35B 'obtain':55B 'requir':51B 'self':21B 'self-host':20B 'though':47B 'unauthent':23B 'unauthor':45B 'vendor':24B 'way':57B","search_c":"'6.6.0':69C '6.6.10':71C '8.0.0':65C '8.0.3':67C 'access':82C 'allow':73C 'attack':75C,88C 'authent':78C 'author':60C 'bypass':77C 'data':96C 'fortiauthent':64C,68C 'fortinet':63C 'full':83C 'gain':80C 'howev':85C 'id':94C 'imperson':84C 'incorrect':59C 'may':72C 'mean':99C 'obtain':90C 'pre':92C 'pre-requir':91C 'requir':86C,93C 'unauthor':81C 'via':97C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126242","severity":null,"published_at":"2026-11-11T22:17:23+00:00","modified_at":"2026-11-11T22:17:23+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126242:3623","url":"https://www.fortiguard.com/psirt/FG-IR-26-257","severity":null,"published_at":"2026-11-11T22:37:30+00:00","modified_at":"2026-11-11T22:37:30+00:00","first_seen_at":"2026-11-11T22:37:30+00:00","fetched_at":"2026-11-11T22:37:30+00:00","note":"Read Fortinet PSIRT FG-IR-26-257 (via search text): fixed 8.0.4 and 6.6.11; unauthenticated API, not exploited, no virtual patch; shared with CVE-2026-126243. No exploitation or PoC; no social search done (B tier).","cites":["https://www.fortiguard.com/psirt/FG-IR-26-257"]}],"documents":[{"id":129667,"url":"https://www.fortiguard.com/psirt/FG-IR-26-257","title":"Fortinet FG-IR-26-257 Incorrect authorization (FortiAuthenticator)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}