---
id: "CVE-2026-126248"
page: "https://infrastack.ai/live/CVE-2026-126248"
kind: "vulnerability"
aliases: ["CVE-2026-126248"]
title: "Fortinet FortiAuthenticator: insufficiently protected credentials leak through HTTPS requests"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "FortiAuthenticator", "fixed": ["8.0.4", "6.6.11"], "affected": ">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["fortiauthenticator", "fortinet", "infrastructure", "self-hosted"]
not_affected_if: ["outside-stated-versions", "patched-version"]
published_at: "2026-11-11T22:17:24+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:36:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126248", "first_seen_at": "2026-11-11T22:29:33+00:00"}, {"source": "analyst", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-262", "first_seen_at": "2026-11-11T22:36:27+00:00", "cites": ["https://fortiguard.fortinet.com/psirt/FG-IR-26-262"]}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: insufficiently protected credentials leak through HTTPS requests

Link for people: https://infrastack.ai/live/CVE-2026-126248 (this .md is for agents)

Fortinet FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 may expose stored credentials in responses to HTTPS requests. An unauthenticated attacker could obtain sensitive information, which may include login credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:FortiAuthenticator affected >= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10 fixed 8.0.4, 6.6.11

## How to check

Check the FortiAuthenticator version in the admin GUI (or 'get system status' on the CLI). Exposed if it is 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 and the HTTPS interface is reachable by an attacker.

## Fix

Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126248
- 2026-11-11T22:36:27+00:00 analyst https://fortiguard.fortinet.com/psirt/FG-IR-26-262 — Read Fortinet FG-IR-26-262: fixed 8.0.4 / 6.6.11, no virtual patch, not known exploited. Advisory does not say which credentials leak.

## Documents

- [advisory] Fortinet FG-IR-26-262 Insufficiently protected credentials https://fortiguard.fortinet.com/psirt/FG-IR-26-262

## From the sources

A insufficiently protected credentials vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to obtain sensitive information via HTTPS requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_