Description
A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).
Metrics
CVSS 3.1 8.2/10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:NWeakness enumeration
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
No affected versions have been published.
Timeline
- Published
- Nov 11, 2026
- Last modified
- Nov 12, 2026
- NVD status
- Awaiting Analysis