LDAP Injection Vulnerability in Fortinet FortiAuthenticator Products
CVE-2026-126240

8.2HIGH

Key Information:

Vendor

Fortinet
Status
Fortiauthenticator
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126240?

An LDAP injection vulnerability exists in Fortinet FortiAuthenticator versions 8.0.0 to 8.0.3 and 6.6.0 to 6.6.10. This security flaw allows an authenticated attacker to bypass authentication by exploiting a weakness in how special elements are processed within LDAP queries. The attack can succeed if an upstream Identity Provider (IdP) is maliciously configured or compromised, or if the IdP settings permit control over the NameID or related SAML attributes used as a username. Carefully reviewing and securing your IdP configuration is essential to mitigate this risk.

Affected Version(s)

FortiAuthenticator 8.0.0 <= 8.0.3

FortiAuthenticator 6.6.0 <= 6.6.10

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-255

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.