{"id":"CVE-2026-126251","kind":"vulnerability","aliases":["CVE-2026-126251"],"related":[],"title":"Fortinet FortiAuthenticator: incorrect authorization lets attackers bypass login","description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access.","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an incorrect authorization flaw. An attacker may bypass authentication and gain unauthorized access.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","fortiauthenticator","fortinet","infrastructure","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed FortiAuthenticator version in the admin interface against the affected ranges: 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.","fix":"- Move to a FortiAuthenticator version outside the affected ranges; the sources do not name the fixed version.","status":"open","published_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:05+00:00","updated_at":"2026-11-11T22:31:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T22:31:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a FortiAuthenticator version outside the affected ranges; the sources do not name the fixed version.","reach":"unknown","title":"Fortinet FortiAuthenticator: incorrect authorization lets attackers bypass login","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain an incorrect authorization flaw. An attacker may bypass authentication and gain unauthorized access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortiauthenticator","fortinet","self-hosted","authentication"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses login and gains unauthorized access to the appliance","analyst_note":"Confirm the fixed version and the exposure conditions from Fortinet's PSIRT advisory for CVE-2026-126251; the NVD entry alone does not name them.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface against the affected ranges: 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10.\n- unknown for other checks: the sources do not say which feature or endpoint is involved.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"FortiAuthenticator appliances in the affected version ranges are exposed to authentication bypass. The sources do not say which configuration or network exposure is required. Deployments outside the listed ranges are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000756,"input_tokens":4566,"output_tokens":599,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126251':11A,14A '-2026':10A,13A '6.6.0':27B,55C '6.6.10':29B,57C '8.0.0':23B,51C '8.0.3':25B,53C 'access':43B,68C 'allow':59C 'attack':6A,36B,61C 'authent':15B,39B,64C 'author':4A,33B,46C 'bypass':7A,38B,63C 'contain':30B 'cve':9A,12A 'flaw':34B 'fortiauthent':2A,16B,22B,50C,54C 'fortinet':1A,17B,49C 'gain':41B,66C 'host':21B 'incorrect':3A,32B,45C 'infrastructur':18B 'let':5A 'login':8A 'may':37B,58C 'self':20B 'self-host':19B 'unauthor':42B,67C 'vulner':47C","nicknames":[],"mitigations":[],"who_affected":"FortiAuthenticator appliances in the affected version ranges are exposed to authentication bypass. The sources do not say which configuration or network exposure is required. Deployments outside the listed ranges are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","critical","fortiauthenticator","fortinet","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126251':11A,14A '-2026':10A,13A 'attack':6A 'author':4A 'bypass':7A 'cve':9A,12A 'fortiauthent':2A 'fortinet':1A 'incorrect':3A 'let':5A 'login':8A","search_b":"'6.6.0':27B '6.6.10':29B '8.0.0':23B '8.0.3':25B 'access':43B 'attack':36B 'authent':15B,39B 'author':33B 'bypass':38B 'contain':30B 'flaw':34B 'fortiauthent':16B,22B 'fortinet':17B 'gain':41B 'host':21B 'incorrect':32B 'infrastructur':18B 'may':37B 'self':20B 'self-host':19B 'unauthor':42B","search_c":"'6.6.0':55C '6.6.10':57C '8.0.0':51C '8.0.3':53C 'access':68C 'allow':59C 'attack':61C 'authent':64C 'author':46C 'bypass':63C 'fortiauthent':50C,54C 'fortinet':49C 'gain':66C 'incorrect':45C 'may':58C 'unauthor':67C 'vulner':47C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126251","severity":null,"published_at":"2026-11-11T22:17:25+00:00","modified_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}