{"id":"CVE-2026-126250","kind":"vulnerability","aliases":["CVE-2026-126250"],"related":[],"title":"Fortinet FortiAuthenticator: unauthenticated denial of service via HTTP requests","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to cause a denial of service via HTTP requests.","summary":"Incorrect authorization (CWE-863, in the django-guest component, API) in FortiAuthenticator lets an unauthenticated attacker cause denial of service via HTTP requests. CVSS 8.2. Fortinet says not known exploited; found internally.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"FortiAuthenticator","fixed":["8.0.4","6.6.11"],"affected":">= 8.0.0, <= 8.0.3; >= 6.6.0, <= 6.6.10","ecosystem":"vendor"}],"ecosystems":[],"tags":["authentication","fortiauthenticator","fortinet","self-hosted","unauthenticated","vendor"],"not_affected_if":[],"how_to_check":"Check the FortiAuthenticator version (GUI dashboard or CLI 'get system status'). Affected: 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10. Exposed if the web/API interface is reachable by an attacker, no login needed.","fix":"Upgrade FortiAuthenticator 8.0.x to 8.0.4 or above; 6.6.x to 6.6.11 or above (Fortinet FG-IR-26-264). No workaround or virtual patch listed.","status":"open","published_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:36+00:00","updated_at":"2026-11-11T22:36:36+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-11T22:31:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Fortinet FortiAuthenticator: unauthenticated denial of service via HTTP requests","impact":"low","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an incorrect authorization flaw. An unauthenticated attacker can send HTTP requests to make the service unavailable.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["fortiauthenticator","fortinet","authentication","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Authentication service becomes unavailable to legitimate users","analyst_note":"Check the Fortinet PSIRT advisory for a fixed version and whether the HTTP interface must be reachable; the NVD entry gives neither.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface against the ranges above\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 are named in the sources. The sources do not say which configurations expose the HTTP interface. Teams running these versions should treat the appliance as potentially exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4570,"output_tokens":523,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Fortinet PSIRT advisory for a fixed version and whether the HTTP interface must be reachable; the NVD entry gives neither.","search":"'-126250':12A,15A '-2026':11A,14A '-863':28B '6.6.0':69C '6.6.10':71C '8.0.0':65C '8.0.3':67C '8.2':50B 'allow':73C 'api':35B 'attack':41B,76C 'authent':17B 'author':26B,60C 'caus':42B,78C 'compon':34B 'cve':10A,13A 'cvss':49B 'cwe':27B 'denial':4A,43B,80C 'django':32B 'django-guest':31B 'exploit':55B 'fortiauthent':2A,18B,37B,64C,68C 'fortiauthenticator':16A 'fortinet':1A,19B,51B,63C 'found':56B 'guest':33B 'host':22B 'http':8A,47B,84C 'incorrect':25B,59C 'intern':57B 'known':54B 'let':38B 'may':72C 'request':9A,48B,85C 'say':52B 'self':21B 'self-host':20B 'servic':6A,45B,82C 'unauthent':3A,23B,40B,75C 'vendor':24B 'via':7A,46B,83C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 are named in the sources. The sources do not say which configurations expose the HTTP interface. Teams running these versions should treat the appliance as potentially exposed.","tier":"B","verified":{"fix":{"at":"2026-11-11T22:36:36Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-264","run_id":3618},"products":{"at":"2026-11-11T22:36:36Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-264","run_id":3618},"how_to_check":{"at":"2026-11-11T22:36:36Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-264","run_id":3618},"who_affected":{"at":"2026-11-11T22:36:36Z","by":"analyst","doc":"https://www.fortiguard.com/psirt/FG-IR-26-264","run_id":3618}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fortiauthenticator"],"ptokens":["fortiauthenticator"],"labels":["authentication","fortiauthenticator","fortinet","high","selfhosted","unauthenticated","vendor"],"campaign_type":null,"search_a":"'-126250':12A,15A '-2026':11A,14A 'cve':10A,13A 'denial':4A 'fortiauthent':2A 'fortiauthenticator':16A 'fortinet':1A 'http':8A 'request':9A 'servic':6A 'unauthent':3A 'via':7A","search_b":"'-863':28B '8.2':50B 'api':35B 'attack':41B 'authent':17B 'author':26B 'caus':42B 'compon':34B 'cvss':49B 'cwe':27B 'denial':43B 'django':32B 'django-guest':31B 'exploit':55B 'fortiauthent':18B,37B 'fortinet':19B,51B 'found':56B 'guest':33B 'host':22B 'http':47B 'incorrect':25B 'intern':57B 'known':54B 'let':38B 'request':48B 'say':52B 'self':21B 'self-host':20B 'servic':45B 'unauthent':23B,40B 'vendor':24B 'via':46B","search_c":"'6.6.0':69C '6.6.10':71C '8.0.0':65C '8.0.3':67C 'allow':73C 'attack':76C 'author':60C 'caus':78C 'denial':80C 'fortiauthent':64C,68C 'fortinet':63C 'http':84C 'incorrect':59C 'may':72C 'request':85C 'servic':82C 'unauthent':75C 'via':83C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126250","severity":null,"published_at":"2026-11-11T22:17:24+00:00","modified_at":"2026-11-11T22:17:24+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126250:3618","url":"https://www.fortiguard.com/psirt/FG-IR-26-264","severity":null,"published_at":"2026-11-11T22:36:36+00:00","modified_at":"2026-11-11T22:36:36+00:00","first_seen_at":"2026-11-11T22:36:36+00:00","fetched_at":"2026-11-11T22:36:36+00:00","note":"Fortinet PSIRT FG-IR-26-264 read: affected/fixed versions, unauthenticated, not known exploited, no virtual patch. Reachability of HTTP interface not stated beyond 'HTTP requests'; component API.","cites":["https://www.fortiguard.com/psirt/FG-IR-26-264"]}],"documents":[{"id":129663,"url":"https://www.fortiguard.com/psirt/FG-IR-26-264","title":"FG-IR-26-264 Incorrect authorization in django-guest (FortiAuthenticator)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}