FortiAuthenticator flaw may let attackers exhaust resources
Original title: Allocation of resources without limits or throttling in fastapi
Fortinet rates the unauthenticated CWE-770 issue 7.5; the November 10 note gives no versions, fix, or CVE.
Fortinet PSIRT revised an advisory on November 10 describing an allocation-of-resources-without-limits flaw in FortiAuthenticator. An unauthenticated attacker may exhaust system resources and cause a denial of service. The snippet does not name affected releases, a fix, or exploitation.
Unconfirmed: The title mentions fastapi, but the body describes FortiAuthenticator; versions, a CVE, and exploitation are unstated.
- CVSSv3 score is 7.5 and the weakness is CWE-770.
- The attacker does not need to authenticate.
- The advisory was revised on November 10, 2026.
- The feed title mentions fastapi, while the body names FortiAuthenticator.
Impact: Unauthenticated denial of service through resource exhaustion
| Product | Affected |
|---|---|
| Fortinet FortiAuthenticator | — |
- Vendors
- Fortinet
- Products
- FortiAuthenticator
From the original article
CVSSv3 Score: 7. 5 An Allocation of Resources Without Limits or Throttling vulnerability [CWE-770] in FortiAuthenticator may allow an unauthenticated attacker to exhaust system resources, potentially resulting in a denial of service (DoS). Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.