HIGHCVSS v3.1 8.2Vulnerability
CVE-2026-126240
A improper neutralization of special elements used in an ldap query ('ldap injection') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username).
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss severity
- HIGH
- Cvss score
- 8.2
- Retrieved at
- 2026-11-11T23:50:19+00:00
- Score
- 8.2
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-126240
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- First seen by Signal
- 2026-11-11T23:46:42+00:00
- Name
- CVE-2026-126240
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- Published at
- 2026-11-11T22:17:23.617
- Last modified
- 2026-11-11T22:17:23.617
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph