FortiOS, FortiWeb, and FortiProxy Vulnerability Lets Attackers Bypass FortiCloud SSO Authentication

Fortinet has issued an urgent security advisory regarding a critical vulnerability affecting its FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager product lines.

The security flaw, identified as an Improper Verification of Cryptographic Signature (CWE-347), could allow an unauthenticated attacker to bypass the FortiCloud Single Sign-On (SSO) login authentication.

The vulnerability stems from the device’s failure to verify signatures within SAML messages properly. If exploited, a threat actor could craft a specific SAML message to gain unauthorized administrative access to the device.

The issue was discovered internally by Yonghui Han and Theo Leleu of the Fortinet Product Security team and disclosed publicly on December 9, 2025.

While the FortiCloud SSO login feature is not enabled by default, it poses a significant risk in deployed environments.

When an administrator registers a device to FortiCare using the graphical user interface (GUI), the “Allow administrative login using FortiCloud SSO” toggle is enabled by default. Unless the administrator explicitly disables this switch during registration, the device becomes vulnerable to this bypass immediately.

Mitigation and Workarounds

Fortinet strongly advises customers to upgrade to the latest versions listed below. However, for organizations that cannot patch immediately, a temporary workaround is available. Administrators can mitigate the risk by disabling the FortiCloud login feature.

The following table outlines the vulnerable versions and the required upgrades to remediate the issue.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.