NewsFortinet PSIRT
Fabric API Authentication bypass
Teaser from the source
CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00
This is the RSS-feed teaser. Read the full article at the original source.
Read at Fortinet PSIRTMore on Authentication
Other advisories
- CriticalCVE-2026-62253Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app
- HighCVE-2026-84313TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
- CriticalCVE-2026-77524KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda
- LowCVE-2026-64652GitHub CLI partially discloses authentication tokens in `gh auth status` output in github.com/cli/cli
- HighCVE-2026-107808Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) in github.com/0xJacky/Nginx-UI
- HighCVE-2026-111917Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api
- LowCVE-2026-111062A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
- Not ratedCVE-2026-111062A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
Other news entries
- Ivanti ICS Zero-Day Attacks Highlight Vendor Patching HurdlesNewsDark Reading
- Hackers abuse the Ivanti Connect Secure bug to gain access without accountsNewsCSO Online
- An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.NewsThe Hacker News
- Citrix, Fortinet, Ivanti Patch 29 Vulnerabilities Across Their ProductsNewsSecurityWeek
- The MFA Gaps Attackers are Still ExploitingNewsBleepingComputer
- Improper access control and session management in the web management interfaceNewsFortinet PSIRT
- Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root AccessNewsThe Hacker News
- Unpatched AhsayCBS Vulnerabilities Exploited in the WildNewsSecurityWeek
Source: https://fortiguard.fortinet.com/psirt/FG-IR-26-179
ID