{"affected":[{"defaultStatus":"unaffected","product":"FortiAuthenticator","source":"CNA: fortinet","vendor":"Fortinet","versions":[{"lessThanOrEqual":"8.0.3","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"6.6.10","status":"affected","version":"6.6.0","versionType":"semver"}]}],"cveId":"CVE-2026-126242","cwes":["CWE-863"],"description":"A incorrect authorization vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an attacker to bypass authentication and gain unauthorized access. Full impersonation however requires the attacker to obtain pre-required id and data via other means.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: fortinet","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C","version":"3.1"}],"modifiedAt":1794432680079,"publishedAt":1794432680079,"references":[{"source":"CNA: fortinet","tags":[],"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-257"}],"remediation":[{"kind":"fix","source":"CNA: fortinet","text":"Upgrade to FortiAuthenticator version 8.0.4 or above\nUpgrade to FortiAuthenticator version 6.6.11 or above\nUpgrade to upcoming  FortiAuthenticator version 6.5.8 or above"}],"revision":"fa7d01e4c61e3a260c47a20a0afc0518d3702582b222a4cb3decb1fa498966d0","sources":[{"modifiedAt":1794432680079,"name":"CNA: fortinet","retrievedAt":1794435013640,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126242"}],"ssvc":null,"status":"published","title":"CVE-2026-126242","updatedAt":1794435013640}