Fortinet Patches Critical Authentication Bypass Vulnerabilities

The two security defects impact FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO login authentication enabled.

Fortinet on Tuesday announced patches for 18 vulnerabilities across its products, including two flaws that could allow attackers to bypass authentication.

Tracked as CVE-2025-59718 and CVE-2025-59719 (CVSS score of 9.8), the two bugs are described as improper verification of cryptographic signature issues. They impact FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.

According to Fortinet, the weaknesses allow attackers to send crafted SAML response messages to vulnerable appliances and bypass the FortiCloud SSO login authentication.

The feature, Fortinet explains, is disabled in default factory settings, but is enabled when a new device is registered to FortiCare.

“When an administrator registers the device to FortiCare from the device’s GUI, unless the administrator disables the toggle switch ‘Allow administrative login using FortiCloud SSO’ in the registration page, FortiCloud SSO login is enabled upon registration,” the company notes ...