Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-25-647
Final
1
1
2025-12-09T00:00:00
Current version
2025-12-09T00:00:00
2025-12-09T00:00:00
An Improper Verification of Cryptographic Signature vulnerability[CWE-347] in FortiOS, FortiWeb, FortiProxy and FortiSwitchManager mayallow an unauthenticated attacker to bypass the FortiCloud SSO loginauthentication via a crafted SAML message, if that feature is enabled on the device.Please note that the FortiCloud SSO login feature is not enabled in default factory settings. However, when an administrator registers the device to FortiCare from the device's GUI, unless the administrator disables the toggle switch "Allow administrative login using FortiCloud SSO" in the registration page, FortiCloud SSO login is enabled upon registration. WorkaroundTo prevent being affected by this vulnerability on vulnerableversions, please turn off the FortiCloud login feature (if enabled) temporarily untilupgrading to a non-affected version.To turn off FortiCloud login, go to System -> Settings -> Switch"Allow administrative login using FortiCloud SSO" to Off. Or type thefollowing command in the CLI:config system global set admin-forticloud-sso-login disableend
None
Improper access control
None
Internally discovered and reported by Yonghui Han and Theo Leleu of Fortinet Product Security team.
FortiOS 7.6.3
FortiOS 7.6.2
FortiOS 7.6.1
FortiOS 7.6.0
FortiOS 7.4.8
FortiOS 7.4.7
FortiOS 7.4.6
FortiOS 7.4.5
FortiOS 7.4.4
FortiOS 7.4.3
FortiOS 7.4.2
FortiOS 7.4.1
FortiOS 7.4.0
FortiOS 7.2.11
FortiOS 7.2.10
FortiOS 7.2.9
FortiOS 7.2.8
FortiOS 7.2.7
FortiOS 7.2.6
FortiOS 7.2.5
FortiOS 7.2.4
FortiOS 7.2.3
FortiOS 7.2.2
FortiOS 7.2.1
FortiOS 7.2.0
FortiOS 7.0.17
FortiOS 7.0.16
FortiOS 7.0.15
FortiOS 7.0.14
FortiOS 7.0.13
FortiOS 7.0.12
FortiOS 7.0.11
FortiOS 7.0.10
FortiOS 7.0.9
FortiOS 7.0.8
FortiOS 7.0.7
FortiOS 7.0.6
FortiOS 7.0.5
FortiOS 7.0.4
FortiOS 7.0.3
FortiOS 7.0.2
FortiOS 7.0.1
FortiOS 7.0.0
FortiProxy 7.6.3
FortiProxy 7.6.2
FortiProxy 7.6.1
FortiProxy 7.6.0
FortiProxy 7.4.10
FortiProxy 7.4.9
FortiProxy 7.4.8
FortiProxy 7.4.7
FortiProxy 7.4.6
FortiProxy 7.4.5
FortiProxy 7.4.4
FortiProxy 7.4.3
FortiProxy 7.4.2
FortiProxy 7.4.1
FortiProxy 7.4.0
FortiProxy 7.2.14
FortiProxy 7.2.13
FortiProxy 7.2.12
FortiProxy 7.2.11
FortiProxy 7.2.10
FortiProxy 7.2.9
FortiProxy 7.2.8
FortiProxy 7.2.7
FortiProxy 7.2.6
FortiProxy 7.2.5
FortiProxy 7.2.4
FortiProxy 7.2.3
FortiProxy 7.2.2
FortiProxy 7.2.1
FortiProxy 7.2.0
FortiProxy 7.0.21
FortiProxy 7.0.20
FortiProxy 7.0.19
FortiProxy 7.0.18
FortiProxy 7.0.17
FortiProxy 7.0.16
FortiProxy 7.0.15
FortiProxy 7.0.14
FortiProxy 7.0.13
FortiProxy 7.0.12
FortiProxy 7.0.11
FortiProxy 7.0.10
FortiProxy 7.0.9
FortiProxy 7.0.8
FortiProxy 7.0.7
FortiProxy 7.0.6
FortiProxy 7.0.5
FortiProxy 7.0.4
FortiProxy 7.0.3
FortiProxy 7.0.2
FortiProxy 7.0.1
FortiProxy 7.0.0
FortiSwitchManager 7.2.6
FortiSwitchManager 7.2.5
FortiSwitchManager 7.2.4
FortiSwitchManager 7.2.3
FortiSwitchManager 7.2.2
FortiSwitchManager 7.2.1
FortiSwitchManager 7.2.0
FortiSwitchManager 7.0.5
FortiSwitchManager 7.0.4
FortiSwitchManager 7.0.3
FortiSwitchManager 7.0.2
FortiSwitchManager 7.0.1
FortiSwitchManager 7.0.0
FortiWeb 8.0.0
FortiWeb 7.6.4
FortiWeb 7.6.3
FortiWeb 7.6.2
FortiWeb 7.6.1
FortiWeb 7.6.0
FortiWeb 7.4.9
FortiWeb 7.4.8
FortiWeb 7.4.7
FortiWeb 7.4.6
FortiWeb 7.4.5
FortiWeb 7.4.4
FortiWeb 7.4.3
FortiWeb 7.4.2
FortiWeb 7.4.1
FortiWeb 7.4.0
Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass
CVE-2025-59718
CVE-2025-59719
FortiOS-7.6.3
FortiOS-7.6.2
FortiOS-7.6.1
FortiOS-7.6.0
FortiOS-7.4.8
FortiOS-7.4.7
FortiOS-7.4.6
FortiOS-7.4.5
FortiOS-7.4.4
FortiOS-7.4.3
FortiOS-7.4.2
FortiOS-7.4.1
FortiOS-7.4.0
FortiOS-7.2.11
FortiOS-7.2.10
FortiOS-7.2.9
FortiOS-7.2.8
FortiOS-7.2.7
FortiOS-7.2.6
FortiOS-7.2.5
FortiOS-7.2.4
FortiOS-7.2.3
FortiOS-7.2.2
FortiOS-7.2.1
FortiOS-7.2.0
FortiOS-7.0.17
FortiOS-7.0.16
FortiOS-7.0.15
FortiOS-7.0.14
FortiOS-7.0.13
FortiOS-7.0.12
FortiOS-7.0.11
FortiOS-7.0.10
FortiOS-7.0.9
FortiOS-7.0.8
FortiOS-7.0.7
FortiOS-7.0.6
FortiOS-7.0.5
FortiOS-7.0.4
FortiOS-7.0.3
FortiOS-7.0.2
FortiOS-7.0.1
FortiOS-7.0.0
FortiProxy-7.6.3
FortiProxy-7.6.2
FortiProxy-7.6.1
FortiProxy-7.6.0
FortiProxy-7.4.10
FortiProxy-7.4.9
FortiProxy-7.4.8
FortiProxy-7.4.7
FortiProxy-7.4.6
FortiProxy-7.4.5
FortiProxy-7.4.4
FortiProxy-7.4.3
FortiProxy-7.4.2
FortiProxy-7.4.1
FortiProxy-7.4.0
FortiProxy-7.2.14
FortiProxy-7.2.13
FortiProxy-7.2.12
FortiProxy-7.2.11
FortiProxy-7.2.10
FortiProxy-7.2.9
FortiProxy-7.2.8
FortiProxy-7.2.7
FortiProxy-7.2.6
FortiProxy-7.2.5
FortiProxy-7.2.4
FortiProxy-7.2.3
FortiProxy-7.2.2
FortiProxy-7.2.1
FortiProxy-7.2.0
FortiProxy-7.0.21
FortiProxy-7.0.20
FortiProxy-7.0.19
FortiProxy-7.0.18
FortiProxy-7.0.17
FortiProxy-7.0.16
FortiProxy-7.0.15
FortiProxy-7.0.14
FortiProxy-7.0.13
FortiProxy-7.0.12
FortiProxy-7.0.11
FortiProxy-7.0.10
FortiProxy-7.0.9
FortiProxy-7.0.8
FortiProxy-7.0.7
FortiProxy-7.0.6
FortiProxy-7.0.5
FortiProxy-7.0.4
FortiProxy-7.0.3
FortiProxy-7.0.2
FortiProxy-7.0.1
FortiProxy-7.0.0
FortiSwitchManager-7.2.6
FortiSwitchManager-7.2.5
FortiSwitchManager-7.2.4
FortiSwitchManager-7.2.3
FortiSwitchManager-7.2.2
FortiSwitchManager-7.2.1
FortiSwitchManager-7.2.0
FortiSwitchManager-7.0.5
FortiSwitchManager-7.0.4
FortiSwitchManager-7.0.3
FortiSwitchManager-7.0.2
FortiSwitchManager-7.0.1
FortiSwitchManager-7.0.0
FortiWeb-8.0.0
FortiWeb-7.6.4
FortiWeb-7.6.3
FortiWeb-7.6.2
FortiWeb-7.6.1
FortiWeb-7.6.0
FortiWeb-7.4.9
FortiWeb-7.4.8
FortiWeb-7.4.7
FortiWeb-7.4.6
FortiWeb-7.4.5
FortiWeb-7.4.4
FortiWeb-7.4.3
FortiWeb-7.4.2
FortiWeb-7.4.1
FortiWeb-7.4.0
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
https://fortiguard.fortinet.com/psirt/FG-IR-25-647
Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass
Reference>