SB2026111173 - LDAP injection in FortiAuthenticator

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111173

SB2026111173 - LDAP injection in FortiAuthenticator

Published: November 11, 2026

Security Bulletin ID SB2026111173
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) LDAP injection (CVE-ID: CVE-2026-126240)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper neutralization of special elements used in an ldap query ('ldap injection'). An authenticated attacker can bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).


Remediation

Install update from vendor's website.

References