Authentication Vulnerability in Fortinet FortiWeb Products
CVE-2025-64471

4.4MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortiweb
Vendor
CVE Published:
9 December 2025

What is CVE-2025-64471?

A vulnerability in Fortinet FortiWeb allows an unauthenticated attacker to replace the password with its hash for authentication through crafted HTTP/HTTPS requests. This flaw affects multiple versions of FortiWeb and could lead to unauthorized access without proper credentials.

Affected Version(s)

FortiWeb 8.0.0 <= 8.0.1

FortiWeb 7.6.0 <= 7.6.5

FortiWeb 7.4.0 <= 7.4.10

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-984

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64471 : Authentication Vulnerability in Fortinet FortiWeb Products