CyberCVE

CVE-2025-59923

An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versio

Severity
Low 2.6
CVSS 3.1
Exploited
Not listed
EPSS
0.002
11.9th percentile
Discovered by
Vendor
Vendor advisory field
Published
Dec 9, 2025
Assigned by fortinet

Description

An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.

Weakness: CWE-284

Affected products

Vendor Product Category Matched by
Fortinet FortiAuthenticator Identity / IAM / MFA cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiAuthenticator

Credit

Internally discovered and reported by Dino-Boris Dougoud of the Fortinet Sales team and Eric Wang of the Fortinet Corporate InfoSec team.

Vendor remediation

Upgrade to FortiAuthenticator version 8.0.0 or above Upgrade to FortiAuthenticator version 6.6.7 or above

References

Something wrong here?