CVE Intelligence

Fortinet Fortiauthenticator vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Fortinet Fortiauthenticator: 5 record(s), with affected versions and fixes.
cpe:2.3:a:fortinet:fortiauthenticator

CVE-2025-53379 High · 7.5 CWE-125 Jul 14, 2026
Out-of-bounds Read in Fortinet Fortiauthenticator
A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.
CVE-2026-44277 Critical · 9.8 CWE-284 May 12, 2026
Improper Access Control in Fortinet Fortiauthenticator
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via crafted requests.
CVE-2026-21743 High · 7.2 CWE-862 Feb 10, 2026
Missing Authorization in Fortinet Fortiauthenticator
A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.
CVE-2025-59923 Low · 2.7 CWE-284 Dec 9, 2025
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.4,...
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.
CVE-2025-57823 Low · 2.7 CWE-425 Dec 9, 2025
A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0…
A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints