Research · Dec 9, 2025 · ZeroDay Catalog
Critical Vulnerability in Fortinet Products Allows Bypass of SSO Authentication
A significant vulnerability affecting multiple Fortinet products enables unauthenticated attackers to bypass SSO authentication, posing a severe security risk.
What changed
Fortinet has identified an improper verification of cryptographic signature vulnerability across several versions of its products. This flaw allows attackers to exploit the FortiCloud SSO login authentication by sending a specially crafted SAML response message.
The affected versions include FortiOS 7.6.0 to 7.6.3, 7.4.0 to 7.4.8, 7.2.0 to 7.2.11, and 7.0.0 to 7.0.17, as well as FortiProxy and FortiSwitchManager in similar version ranges.
Who is affected
Organizations utilizing Fortinet products are at risk due to this vulnerability. The following products are specifically impacted:
FortiOS versions 7.0.x to 7.6.x, FortiProxy versions 7.0.x to 7.6.x, and FortiSwitchManager versions 7.0.x to 7.2.x.
- FortiOS versions 7.6.0 through 7.6.3
- FortiProxy versions 7.4.0 through 7.4.10
- FortiSwitchManager versions 7.2.0 through 7.2.6
- Organizations relying on FortiCloud SSO for authentication
What to do
Immediate action is recommended for all users of the affected Fortinet products. It is crucial to update to the latest versions that address this vulnerability.
Monitoring for any unauthorized access attempts and reviewing authentication logs can help mitigate potential exploitation.
- Upgrade to the latest FortiOS, FortiProxy, and FortiSwitchManager versions.
- Implement additional monitoring for SSO authentication processes.
- Review security configurations and access controls related to Fortinet products.