CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Critical FortiCloud SSO Authentication Bypass Vulnerabilities Patched

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Fortinet has released updates to address two critical vulnerabilities (CVE-2025-59718 and CVE-2025-59719) in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that allow attackers to bypass FortiCloud SSO authentication via maliciously crafted SAML messages. The vulnerabilities stem from improper verification of cryptographic signatures. The FortiCloud SSO login feature is not enabled by default but is activated upon FortiCare registration unless explicitly disabled by the administrator. Additionally, Fortinet patched two other vulnerabilities: CVE-2025-59808, which allows attackers to reset account credentials without password prompts, and CVE-2025-64471, which permits authentication using password hashes. These flaws highlight the ongoing exploitation of Fortinet vulnerabilities in cyber-espionage and ransomware attacks.

Timeline

  1. 09.12.2025 20:36 1 articles · 9h ago

    Fortinet patches critical FortiCloud SSO authentication bypass vulnerabilities

    Fortinet has released updates to address two critical vulnerabilities (CVE-2025-59718 and CVE-2025-59719) in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that allow attackers to bypass FortiCloud SSO authentication via maliciously crafted SAML messages. The vulnerabilities stem from improper verification of cryptographic signatures. The FortiCloud SSO login feature is not enabled by default but is activated upon FortiCare registration unless explicitly disabled by the administrator.

    Show sources
    Open in new tab

Information Snippets

  • CVE-2025-59718 and CVE-2025-59719 are critical vulnerabilities affecting FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb, enabling authentication bypass via malformed SAML messages.

    First reported: 09.12.2025 20:36
    1 source, 1 article
    Show sources

  • The FortiCloud SSO login feature is disabled by default but is enabled upon FortiCare registration unless manually disabled.

    First reported: 09.12.2025 20:36
    1 source, 1 article
    Show sources

  • CVE-2025-59808 allows attackers to reset account credentials without password prompts, while CVE-2025-64471 enables authentication using password hashes.

    First reported: 09.12.2025 20:36
    1 source, 1 article
    Show sources

  • Fortinet vulnerabilities are frequently exploited in ransomware and cyber-espionage attacks, including recent incidents involving the Volt Typhoon hacking group.

    First reported: 09.12.2025 20:36
    1 source, 1 article
    Show sources