FortiAuthenticator authorization flaw may bypass authentication
Original title: Incorrect authorization
Fortinet scores the CWE-863 issue 9.1; the revised notice does not name versions, a fix, or exploitation.
A November 10 Fortinet PSIRT revision describes incorrect authorization in FortiAuthenticator. Fortinet says an attacker may bypass authentication and gain unauthorized access. The snippet provides no affected versions, remediation, CVE, or evidence of attacks.
Unconfirmed: Whether authentication is required, which versions are affected, and whether attacks exist are not stated.
- The weakness is classified as CWE-863.
- CVSSv3 score is 9.1.
- Successful use yields unauthorized access.
- The advisory was revised on November 10, 2026.
Impact: Authentication bypass and unauthorized access
| Product | Affected |
|---|---|
| Fortinet FortiAuthenticator | — |
From the original article
CVSSv3 Score: 9. 1 An Incorrect Authorization vulnerability [CWE-863] in FortiAuthenticator may allow an attacker to bypass authentication and gain unauthorized access. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.