---
id: "CVE-2026-126243"
page: "https://infrastack.ai/live/CVE-2026-126243"
kind: "vulnerability"
aliases: ["CVE-2026-126243"]
title: "Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4", "6.6.11"], "affected": ">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authentication", "fortiauthenticator", "fortinet", "self-hosted", "vendor"]
not_affected_if: ["outside-affected-versions"]
published_at: "2026-11-11T22:17:24+00:00"
first_seen_at: "2026-11-11T22:29:32+00:00"
updated_at: "2026-11-11T22:37:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126243", "first_seen_at": "2026-11-11T22:29:32+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-257", "first_seen_at": "2026-11-11T22:37:34+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-257"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: authorization flaw lets attackers bypass login

Link for people: https://infrastack.ai/live/CVE-2026-126243 (this .md is for agents)

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 have an incorrect authorization flaw. An attacker may bypass authentication and gain unauthorized access, though full impersonation also requires identifiers and data obtained by other means.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10 fixed 8.0.4, 6.6.11

## How to check

Check the FortiAuthenticator version in the admin GUI (Dashboard system information) or CLI 'get system status'. Exposed if it is 8.0.0-8.0.3 or 6.6.0-6.6.10. Fortinet says the attack is unauthenticated through the API component, so prioritize appliances whose web/API interface is reachable from untrusted networks.

## Fix

Upgrade FortiAuthenticator 8.0.0-8.0.3 to 8.0.4 or above; 6.6.0-6.6.10 to 6.6.11 or above. Fortinet lists no virtual patch.

## Timeline

- 2026-11-11T22:29:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126243
- 2026-11-11T22:37:34+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-257 — Read Fortinet FG-IR-26-257 (covers CVE-2026-126242 and -126243): fixed 8.0.4 / 6.6.11, not exploited, no virtual patch, attack type unauthenticated, vendor CVSS 7.4. No workaround listed.

## Documents

- [advisory] Fortinet FG-IR-26-257 Incorrect authorization (FortiAuthenticator) https://fortiguard.fortinet.com/psirt/FG-IR-26-257

## From the sources

A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_