{"id":"CVE-2026-126243","kind":"vulnerability","aliases":["CVE-2026-126243"],"related":[],"title":"Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 have an incorrect authorization flaw. An attacker may bypass authentication and gain unauthorized access, though full impersonation also requires identifiers and data obtained by other means.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4","6.6.11"],"affected":">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["authentication","fortiauthenticator","fortinet","self-hosted","vendor"],"not_affected_if":["outside-affected-versions"],"how_to_check":"Check the FortiAuthenticator version in the admin GUI (Dashboard system information) or CLI 'get system status'. Exposed if it is 8.0.0-8.0.3 or 6.6.0-6.6.10. Fortinet says the attack is unauthenticated through the API component, so prioritize appliances whose web/API interface is reachable from untrusted networks.","fix":"Upgrade FortiAuthenticator 8.0.0-8.0.3 to 8.0.4 or above; 6.6.0-6.6.10 to 6.6.11 or above. Fortinet lists no virtual patch.","status":"open","published_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","triaged_at":"2026-11-11T22:33:17+00:00","updated_at":"2026-11-11T22:37:34+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:33:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 have an incorrect authorization flaw. An attacker may bypass authentication and gain unauthorized access, though full impersonation also requires identifiers and data obtained by other means.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortiauthenticator","fortinet","authentication","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses authentication and gains unauthorized access","analyst_note":"Confirm fixed versions and exposure conditions from Fortinet's advisory; the NVD entry gives only the affected ranges.","how_to_check":"- Check the FortiAuthenticator version in the admin interface or with the appliance's system information page and compare it with `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10`.\n- Review Fortinet's advisory for FortiAuthenticator to confirm the affected ranges.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 that use it for authentication. Exposure depends on how the appliance is reachable and whether an attacker can obtain the identifiers and data needed for impersonation. Installations outside those ranges are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4593,"output_tokens":621,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed versions and exposure conditions from Fortinet's advisory; the NVD entry gives only the affected ranges.","search":"'-126243':11A,14A '-2026':10A,13A '6.6.0':28B,68C '6.6.10':30B,70C '8.0.0':24B,64C '8.0.3':26B,66C 'access':44B,81C 'allow':72C 'also':48B 'attack':6A,37B,74C,87C 'authent':16B,40B,77C 'author':3A,34B,59C 'bypass':7A,39B,76C 'cve':9A,12A 'data':52B,95C 'flaw':4A,35B 'fortiauthent':2A,17B,23B,63C,67C 'fortiauthenticator':15A 'fortinet':1A,18B,62C 'full':46B,82C 'gain':42B,79C 'host':21B 'howev':84C 'id':93C 'identifi':50B 'imperson':47B,83C 'incorrect':33B,58C 'let':5A 'login':8A 'may':38B,71C 'mean':56B,98C 'obtain':53B,89C 'pre':91C 'pre-requir':90C 'requir':49B,85C,92C 'self':20B 'self-host':19B 'though':45B 'unauthor':43B,80C 'vendor':22B 'via':96C 'vulner':60C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted FortiAuthenticator 8.0.0-8.0.3 or 6.6.0-6.6.10. Fortinet describes an unauthenticated attack through the API component; full impersonation also needs an id and data the attacker obtains by other means. Versions 8.0.4+, 6.6.11+ and other branches not listed can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:37:34Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257","run_id":3622},"products":{"at":"2026-11-11T22:37:34Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257","run_id":3622},"how_to_check":{"at":"2026-11-11T22:37:34Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257","run_id":3622},"who_affected":{"at":"2026-11-11T22:37:34Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257","run_id":3622}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["authentication","fortiauthenticator","fortinet","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126243':11A,14A '-2026':10A,13A 'attack':6A 'author':3A 'bypass':7A 'cve':9A,12A 'flaw':4A 'fortiauthent':2A 'fortiauthenticator':15A 'fortinet':1A 'let':5A 'login':8A","search_b":"'6.6.0':28B '6.6.10':30B '8.0.0':24B '8.0.3':26B 'access':44B 'also':48B 'attack':37B 'authent':16B,40B 'author':34B 'bypass':39B 'data':52B 'flaw':35B 'fortiauthent':17B,23B 'fortinet':18B 'full':46B 'gain':42B 'host':21B 'identifi':50B 'imperson':47B 'incorrect':33B 'may':38B 'mean':56B 'obtain':53B 'requir':49B 'self':20B 'self-host':19B 'though':45B 'unauthor':43B 'vendor':22B","search_c":"'6.6.0':68C '6.6.10':70C '8.0.0':64C '8.0.3':66C 'access':81C 'allow':72C 'attack':74C,87C 'authent':77C 'author':59C 'bypass':76C 'data':95C 'fortiauthent':63C,67C 'fortinet':62C 'full':82C 'gain':79C 'howev':84C 'id':93C 'imperson':83C 'incorrect':58C 'may':71C 'mean':98C 'obtain':89C 'pre':91C 'pre-requir':90C 'requir':85C,92C 'unauthor':80C 'via':96C 'vulner':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126243","severity":null,"published_at":"2026-11-11T22:17:24+00:00","modified_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:32+00:00","fetched_at":"2026-11-11T22:29:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126243:3622","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257","severity":null,"published_at":"2026-11-11T22:37:34+00:00","modified_at":"2026-11-11T22:37:34+00:00","first_seen_at":"2026-11-11T22:37:34+00:00","fetched_at":"2026-11-11T22:37:34+00:00","note":"Read Fortinet FG-IR-26-257 (covers CVE-2026-126242 and -126243): fixed 8.0.4 / 6.6.11, not exploited, no virtual patch, attack type unauthenticated, vendor CVSS 7.4. No workaround listed.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-257"]}],"documents":[{"id":129666,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257","title":"Fortinet FG-IR-26-257 Incorrect authorization (FortiAuthenticator)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}