{"id":"CVE-2026-126248","kind":"vulnerability","aliases":["CVE-2026-126248"],"related":[],"title":"Fortinet FortiAuthenticator: insufficiently protected credentials leak through HTTPS requests","description":"A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests.","summary":"Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 may expose stored credentials in responses to HTTPS requests. An unauthenticated attacker could obtain sensitive information, which may include login credentials.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4","6.6.11"],"affected":">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["fortiauthenticator","fortinet","infrastructure","self-hosted"],"not_affected_if":["outside-stated-versions","patched-version"],"how_to_check":"Check the FortiAuthenticator version in the admin GUI (or 'get system status' on the CLI). Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 and the HTTPS interface is reachable by an attacker.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above","status":"open","published_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:59+00:00","updated_at":"2026-11-11T22:36:27+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-11T22:31:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAuthenticator: insufficiently protected credentials leak through HTTPS requests","impact":"medium","summary":"Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 may expose stored credentials in responses to HTTPS requests. An unauthenticated attacker could obtain sensitive information, which may include login credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortinet","fortiauthenticator","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker reads sensitive credentials over HTTPS","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions and the exact credentials exposed; the NVD entry alone gives no fix or check.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface and compare it with `8.0.0` through `8.0.3` and `6.6.0` through `6.6.10`\n- unknown for other checks: the sources do not say","plain_action":"","product_name":"FortiAuthenticator","needs_analyst":true,"not_affected_if":["outside-stated-versions"],"who_is_affected":"FortiAuthenticator appliances running 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are in the stated range. The sources do not say which configurations or network exposures are needed, so whether an internal-only appliance is reachable is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000763,"input_tokens":4563,"output_tokens":614,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for the fixed versions and the exact credentials exposed; the NVD entry alone gives no fix or check.","search":"'-126248':12A,15A '-2026':11A,14A '6.6.0':29B,65C '6.6.10':31B,67C '8.0.0':25B,61C '8.0.3':27B,63C 'allow':69C 'attack':43B,72C 'could':44B 'credenti':5A,35B,52B,56C 'cve':10A,13A 'expos':33B 'fortiauthent':2A,17B,24B,60C,64C 'fortiauthenticator':16A 'fortinet':1A,18B,23B,59C 'host':22B 'https':8A,39B,78C 'includ':50B 'inform':47B,76C 'infrastructur':19B 'insuffici':3A,54C 'leak':6A 'login':51B 'may':32B,49B,68C 'obtain':45B,74C 'protect':4A,55C 'request':9A,40B,79C 'respons':37B 'self':21B 'self-host':20B 'sensit':46B,75C 'store':34B 'unauthent':42B,71C 'via':77C 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted FortiAuthenticator appliances or VMs on 8.0.0-8.0.3 or 6.6.0-6.6.10. An unauthenticated attacker who can reach the HTTPS API can obtain sensitive information via HTTPS requests; Fortinet's advisory does not specify which credentials. Teams not running FortiAuthenticator, or on 8.0.4+/6.6.11+, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:36:27Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262","run_id":3620},"products":{"at":"2026-11-11T22:36:27Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262","run_id":3620},"how_to_check":{"at":"2026-11-11T22:36:27Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262","run_id":3620},"who_affected":{"at":"2026-11-11T22:36:27Z","by":"analyst","doc":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262","run_id":3620}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["fortiauthenticator","fortinet","high","infrastructure","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126248':12A,15A '-2026':11A,14A 'credenti':5A 'cve':10A,13A 'fortiauthent':2A 'fortiauthenticator':16A 'fortinet':1A 'https':8A 'insuffici':3A 'leak':6A 'protect':4A 'request':9A","search_b":"'6.6.0':29B '6.6.10':31B '8.0.0':25B '8.0.3':27B 'attack':43B 'could':44B 'credenti':35B,52B 'expos':33B 'fortiauthent':17B,24B 'fortinet':18B,23B 'host':22B 'https':39B 'includ':50B 'inform':47B 'infrastructur':19B 'login':51B 'may':32B,49B 'obtain':45B 'request':40B 'respons':37B 'self':21B 'self-host':20B 'sensit':46B 'store':34B 'unauthent':42B","search_c":"'6.6.0':65C '6.6.10':67C '8.0.0':61C '8.0.3':63C 'allow':69C 'attack':72C 'credenti':56C 'fortiauthent':60C,64C 'fortinet':59C 'https':78C 'inform':76C 'insuffici':54C 'may':68C 'obtain':74C 'protect':55C 'request':79C 'sensit':75C 'unauthent':71C 'via':77C 'vulner':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126248","severity":null,"published_at":"2026-11-11T22:17:24+00:00","modified_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126248:3620","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262","severity":null,"published_at":"2026-11-11T22:36:27+00:00","modified_at":"2026-11-11T22:36:27+00:00","first_seen_at":"2026-11-11T22:36:27+00:00","fetched_at":"2026-11-11T22:36:27+00:00","note":"Read Fortinet FG-IR-26-262: fixed 8.0.4 / 6.6.11, no virtual patch, not known exploited. Advisory does not say which credentials leak.","cites":["https://fortiguard.fortinet.com/psirt/FG-IR-26-262"]}],"documents":[{"id":129661,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-262","title":"Fortinet FG-IR-26-262 Insufficiently protected credentials","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}