FortiOS RADIUS two-factor flaw accepts an invalid token
Original title: Broken Access Control in Two-Factor-Authentication
A read-only authenticated user can reach the GUI when RADIUS returns Access-Challenge after a bad token; CVSS 5.9.
Fortinet revised FG-IR-26-195 on November 10. Improper authentication in FortiOS Remote RADIUS Type Admin two-factor authentication may let a remote authenticated attacker with at least read-only permission log in to the FortiOS GUI with an invalid token after a valid username and password, when the RADIUS server returns an additional Access-Challenge after that invalid token. The score is CVSSv3 5.9. No versions, fix, or exploitation status is stated.
Unconfirmed: Affected FortiOS versions, a fix, and exploitation status are not stated.
- CVSSv3 score is 5.9; weakness is CWE-287.
- The attacker needs at least read-only permission and valid credentials.
- The RADIUS server must return an extra Access-Challenge.
- Advisory revised on November 10, 2026.
Impact: GUI login with an invalid two-factor token
| Product | Affected |
|---|---|
| Fortinet FortiOS | — |
From the original article
CVSSv3 Score: 5.
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.