Skip to content
NewA calmer, faster ZeroHour
Advisoryhigh

JWT used for authentication in web GUI signed with static key

Fortinet PSIRT ()1
Read at fortiguard.fortinet.com
AI summary · glm-5.3Summaries by Vani AI

Fortinet warns that FortiMonitorOnSight's web GUI uses JWTs signed with a static key, enabling remote unauthenticated authentication bypass.

Fortinet advisory FG-IR-26-170 discloses a CVSS 9.6 vulnerability (CWE-540, sensitive information in source code) in the FortiMonitorOnSight web portal. The web GUI's JWT authentication tokens are signed with a static key, allowing a remote unauthenticated attacker to bypass authentication via forged or reused JWTs. The advisory was revised on September 8, 2026.

Key facts
  • CVSS 9.6 flaw in FortiMonitorOnSight web portal
  • JWTs signed with static key allow forged-token authentication bypass
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
authentication-bypassfortimonitoronsightfortinetjwtpsirtstatic-key

From the original article

CVSSv3 Score: 9. 6 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00

Fortinet PSIRT

fortiguard.fortinet.com

Read the full article at Fortinet PSIRT

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.