FortiOS RADIUS two-factor flaw accepts an invalid token
A read-only authenticated user can reach the GUI when RADIUS returns Access-Challenge after a bad token; CVSS 5.9.
Stories per day · 30 days
2 RSS
Relatedfortinet2android1bod-26-041cisa-kev1code-execution1email-quarantine1fortimail1fortios1gpustack1microsoft-authenticator1microsoft-graph1radius1token-theft1two-factor1
7 stories, newest first · one card per story
Stories tagged #improper-authentication
FortiMail flaw lets attackers release or delete quarantined mail
An unauthenticated attacker can target arbitrary mailboxes through crafted quarantine release requests, scored CVSS 8.2.
CISA adds GPUStack improper authentication flaw to KEV (CVE-2026-102895)
Unauthenticated callers can change users and models, create admin API keys, read secrets, and execute code.
Android Microsoft Authenticator flaw let apps steal account tokens
CVE-2026-80097, scored 8.6, affects builds before 6.2606.4246; a zero-permission app could impersonate Microsoft apps.
1
VU#676317: Norwegian Cruise Line door access controller contains an improper authentication vulnerability
CERT warns Norwegian Cruise Line door readers accept cloned RFID UIDs, allowing forged keycards into restricted ship areas.
ZDI-26-711: NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability
ZDI disclosed CVE-2026-92209, an improper authentication flaw in NoMachine's bundled Redis component allowing local privilege escalation (CVSS 7.8).
Improper Authentication of FortiPAM Server
Fortinet discloses CVSS 9.1 improper authentication in FortiPAM's Chrome extension allowing unauthenticated attackers to proxy victims' browser traffic.