FO
Product
FortiAuthenticator
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 6Medium 8Low 3
Watch
Add FortiAuthenticator to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44277 | 9.8 | May 12 | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through… Affected: 8.0.2; 8.0.0; 6.6.0 through 6.6.8; 6.5.0 through 6.5.6; 6.4.0 through 6.4.10 |
| CVE-2021-26116 | 8.8 | Apr 6 | An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow an authenticated… Affected: 5.0.0 before 6.3.1 |
| CVE-2021-43068 | 8.1 | Dec 9 | A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal Affected: 6.4.0 |
| CVE-2025-53379 | 7.5 | Jul 14 | A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve… Affected: 6.6.0 through 6.6.2; 6.5.0 through 6.5.7; 6.4.0 through 6.4.11; 6.3.0 through 6.3.5 |
| CVE-2021-22124 | 7.5 | Aug 4 | An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and… Affected: 4.0.0 through 4.3.4; 5.0.0 through 5.5.0; 6.0.0 before 6.0.6 |
| CVE-2021-24005 | 7.5 | Jul 6 | Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with access to the files or… Affected: 6.0.0 before 6.3.0 |
| CVE-2026-21743 | 7.2 | Feb 10 | A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions,… Affected: 6.3.0 before 6.6.7 |
| CVE-2021-43067 | 6.5 | Dec 8 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and… Affected: 6.0.1 through 6.0.7; 6.1.0; 6.1.1; 6.1.2; 6.2.0; 6.2.1; +4 more |
| CVE-2022-23439 | 6.1 | Jan 22 | A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host`… Affected: 6.3.0 before 6.3.4; 6.4.0 before 6.4.2 |
| CVE-2024-23664 | 6.1 | Jun 3 | A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to… Affected: 6.4.0 before 6.5.4; 6.6.0 |
| CVE-2022-35850 | 6.1 | Apr 11 | An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions… Affected: 6.1.0 before 6.3.4; 6.4.0 before 6.4.7 |
| CVE-2019-16154 | 6.1 | Jan 7 | An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS)… Affected: 6.0.0 |
| CVE-2018-9186 | 6.1 | May 31 | A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized… Affected: 4.0.0 before 5.3.0 |
| CVE-2023-26208 | 5.3 | Mar 9 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenticated attacker to… Affected: 5.4.0 before 6.5.0 |
| CVE-2021-36177 | 4.3 | Feb 2 | An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan as the HA… Affected: 6.0.0 before 6.3.3 |
| CVE-2022-22302 | 3.3 | Jul 11 | A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and… Affected: 6.0.0 through 6.0.4; 5.5.0; 6.1.0 |
| CVE-2025-59923 | 2.7 | Dec 9 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions,… Affected: 6.3.0 through 6.6.4 |
| CVE-2025-57823 | 2.7 | Dec 9 | A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions,… Affected: 6.3.0 through 6.6.6 |
| CVE-2015-1459 | – | Feb 3 | Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to… Affected: 3.0.0 |
| CVE-2015-1458 | – | Feb 3 | Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the… Affected: 3.0.0 |
| CVE-2015-1457 | – | Feb 3 | Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command Affected: 3.0.0 |
| CVE-2015-1456 | – | Feb 3 | Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log… Affected: 3.0.0 |
| CVE-2015-1455 | – | Feb 3 | Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL user, which makes it easier for remote… Affected: 3.0.0 |
| CVE-2013-6990 | – | Apr 30 | FortiGuard FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface Affected: through 2.2 |
Showing 24