Ethical Hacking News

Fortinet Warns of Critical FortiCloud SSO Login Auth Bypass Flaws: A Growing Concern for Cybersecurity

Fortinet has warned of two critical vulnerabilities in its products that could allow attackers to bypass FortiCloud SSO authentication. These flaws highlight the need for organizations to prioritize their cybersecurity efforts and take proactive steps to address potential weaknesses.

Fortinet has warned of two critical vulnerabilities in its products: CVE-2025-59718 and CVE-2025-59719.

The flaws allow attackers to bypass FortiCloud SSO authentication by abusing improper verification of cryptographic signature weaknesses.

Admins are advised to temporarily disable the FortiCloud login feature until they upgrade to a non-vulnerable version.

Fortinet has patched an unverified password change vulnerability and another that enables threat actors to authenticate using a hash instead of a password.

These vulnerabilities have been frequently exploited in ransomware and cyber-espionage attacks, often as zero days.

Fortinet has issued several security updates to patch vulnerabilities in its FortiSIEM and FortiWeb products.

In a recent security update, Fortinet has warned of two critical vulnerabilities in its FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager products. These flaws, tracked as CVE-2025-59718 and CVE-2025-59719, could allow attackers to bypass FortiCloud SSO authentication by abusing improper verification of cryptographic signature weaknesses in vulnerable products via a maliciously crafted SAML message.

According to the security update published by Fortinet, the vulnerable FortiCloud feature is not enabled by default when the device is not registered with FortiCare. However, if an administrator registers the device from the device's GUI and enables the "Allow administrative login using FortiCloud SSO" toggle switch in the registration page, then FortiCloud SSO login becomes enabled.

To protect their systems against attacks exploiting these vulnerabilities, admins are advised to temporarily disable the FortiCloud login feature (if enabled) until they upgrade to a non-vulnerable version. This can be done by navigating to System -> Settings and switching "Allow administrative login using FortiCloud SSO" to Off or running the command config system global set admin-forticloud-sso-login disable from the command-line interface.

Furthermore, Fortinet has patched an unverified password change vulnerability (CVE-2025-59808) that allows attackers who gain access to a victim's user account to reset the account credentials without being prompted for the account's password. Additionally, another vulnerability (CVE-2025-64471) enables threat actors to authenticate using the hash in place of the password.

These vulnerabilities have been frequently exploited by Fortinet security vulnerabilities in both ransomware and cyber-espionage attacks, often as zero days. For instance, in February, Fortinet disclosed that the Chinese Volt Typhoon hacking group backdoored a Dutch Ministry of Defence military network using custom Coathanger remote access trojan (RAT) malware after exploiting two FortiOS SSL VPN flaws.

More recently, in August, Fortinet patched a command injection vulnerability (CVE-2025-25256) with publicly available exploit code in its FortiSIEM security monitoring solution. Furthermore, in November, Fortinet warned of a FortiWeb zero-day (CVE-2025-58034) that was actively exploited in attacks, one week after confirming that it had silently patched another massively exploited FortiWeb zero-day (CVE-2025-64446).

As cybersecurity threats continue to evolve and become more sophisticated, it is essential for organizations to stay vigilant and proactive in protecting their systems. The recent security update from Fortinet serves as a reminder of the importance of regular patching and software updates, as well as implementing robust security measures such as multi-factor authentication and monitoring.

Moreover, the growing concern over FortiCloud SSO login auth bypass flaws highlights the need for organizations to assess their current security posture and identify potential vulnerabilities. By taking proactive steps to address these weaknesses, businesses can significantly reduce the risk of a successful cyberattack.

In conclusion, the recent security update from Fortinet is a wake-up call for organizations to prioritize their cybersecurity efforts. By understanding the risks associated with FortiCloud SSO login auth bypass flaws and implementing necessary measures to protect themselves, businesses can ensure a safer digital environment for their users.

Related Information:

https://www.ethicalhackingnews.com/articles/Fortinet-Warns-of-Critical-FortiCloud-SSO-Login-Auth-Bypass-Flaws-A-Growing-Concern-for-Cybersecurity-ehn.shtml

https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-forticloud-sso-login-auth-bypass-flaws/

https://securityblotter.com/fortinet-fortios-authentication-bypass-a-super-admins-worst-nightmare/

https://nvd.nist.gov/vuln/detail/CVE-2025-59718

https://www.cvedetails.com/cve/CVE-2025-59718/

https://nvd.nist.gov/vuln/detail/CVE-2025-59719

https://www.cvedetails.com/cve/CVE-2025-59719/

https://nvd.nist.gov/vuln/detail/CVE-2025-59808

https://www.cvedetails.com/cve/CVE-2025-59808/

https://nvd.nist.gov/vuln/detail/CVE-2025-64471

https://www.cvedetails.com/cve/CVE-2025-64471/

https://nvd.nist.gov/vuln/detail/CVE-2025-25256