---
id: "CVE-2026-126242"
page: "https://infrastack.ai/live/CVE-2026-126242"
kind: "vulnerability"
aliases: ["CVE-2026-126242"]
title: "Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4"], "affected": ">= 8.0.0, <= 8.0.3", "ecosystem": "vendor"}, {"name": "FortiAuthenticator 6.6", "fixed": ["6.6.11"], "affected": ">= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["fortiauthenticator", "fortinet", "self-hosted", "unauthenticated", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-11T22:17:23+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:37:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126242", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://www.fortiguard.com/psirt/FG-IR-26-257", "first_seen_at": "2026-11-11T22:37:30+00:00", "cites": ["https://www.fortiguard.com/psirt/FG-IR-26-257"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login

Link for people: https://infrastack.ai/live/CVE-2026-126242 (this .md is for agents)

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 have an incorrect authorization flaw. An attacker can bypass authentication and gain unauthorized access, though full impersonation also requires identifiers and data obtained another way.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3 fixed 8.0.4
- vendor:FortiAuthenticator 6.6 affected >= 6.6.0, <= 6.6.10 fixed 6.6.11

## How to check

Check the FortiAuthenticator version in the admin GUI (or 'get system status' on the CLI). Affected: 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. Versions 8.0.4+ and 6.6.11+ are fixed. Fortinet lists the attack type as unauthenticated (API component), so treat any instance whose management/API is reachable as exposed.

## Fix

Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above. No virtual patch or workaround listed by Fortinet.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126242
- 2026-11-11T22:37:30+00:00 analyst https://www.fortiguard.com/psirt/FG-IR-26-257 — Read Fortinet PSIRT FG-IR-26-257 (via search text): fixed 8.0.4 and 6.6.11; unauthenticated API, not exploited, no virtual patch; shared with CVE-2026-126243. No exploitation or PoC; no social search done (B tier).

## Documents

- [advisory] Fortinet FG-IR-26-257 Incorrect authorization (FortiAuthenticator) https://www.fortiguard.com/psirt/FG-IR-26-257

## From the sources

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_