PSIRT2FA request can be replayed without a valid token after one successful request
Summary
An Improper authentication vulnerability [CWE-287] in FortiSOAR web GUI may allow an unauthenticated attacker to bypass authentication via replaying captured 2FA request. The attack requires being able to intercept and decrypt authentication traffic and precise timing to replay the request before token expiration.
| Version | Affected | Solution |
|---|---|---|
| FortiSOAR PaaS 7.6 | 7.6.0 through 7.6.3 | Upgrade to 7.6.4 or above |
| FortiSOAR PaaS 7.5 | 7.5.0 through 7.5.2 | Upgrade to 7.5.3 or above |
| FortiSOAR PaaS 7.4 | Not affected | Not Applicable |
| FortiSOAR PaaS 7.3 | Not affected | Not Applicable |
| FortiSOAR on-premise 7.6 | 7.6.0 through 7.6.3 | Upgrade to 7.6.4 or above |
| FortiSOAR on-premise 7.5 | 7.5.0 through 7.5.2 | Upgrade to 7.5.3 or above |
| FortiSOAR on-premise 7.4 | Not affected | Not Applicable |
| FortiSOAR on-premise 7.3 | Not affected | Not Applicable |
Acknowledgement
Internally discovered and reported by Leslie Zhou of Fortinet PSIRT team.Timeline
2026-04-14: Initial publication