Open Redirect Vulnerability in Fortinet FortiAuthenticator Products
CVE-2026-121526

5.8MEDIUM

Key Information:

Vendor

Fortinet
Status
Fortiauthenticator
Vendor
CVE Published:
11 November 2026

What is CVE-2026-121526?

An open redirect vulnerability exists in the Fortinet FortiAuthenticator products from versions 8.0.0 to 8.0.3 and 6.6.0 to 6.6.10. This flaw allows an unauthenticated attacker to craft specific HTTP requests that can redirect users to untrusted sites. Such attacks can be leveraged for phishing, malware distribution, and other malicious activities. Organizations using the affected versions should prioritize applying relevant security patches.

Affected Version(s)

FortiAuthenticator 8.0.0 <= 8.0.3

FortiAuthenticator 6.6.0 <= 6.6.10

FortiAuthenticator 6.5.0 <= 6.5.7

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-191

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.