CVE-2026-126240
HIGH
MEDIUM
Priority: 0.02
BB Relevance:
56/100
Published: 2026-11-11
Modified: 2026-11-12
First seen: 2026-11-11
Status: active
Attack Surface
Network
No Interaction
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
Changed
C:
High
I:
High
A:
None
Description
A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Fortinet | FortiAuthenticator | 8.0.0 |
| Fortinet | FortiAuthenticator | 6.6.0 |