Improper neutralization of special elements used in an ldap query
CVSSv3 Score: 8.2 An Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')[CWE-90] in FortiAuthenticator may allow an authenticated attacker to bypass authentication. Successful exploitation requires either a malicious/compromised upstream IdP, or an IdP configuration that allows the user to control the NameID (or the SAML attribute used as the username). Revised on 2026-11-10 00:00:00
Read at Fortinet PSIRT Advisories
- Vendor
- Fortinet
- Product
- FortiNAC / FortiAuthenticator
- CVSS v3.0
- 8.2
- Exposure class
- Identity
Why it ranks 51 (High)
- CVSS v3.0 8.2 high
- Exposed product class: identity
- Widely deployed vendor product (Fortinet)
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Fortinet PSIRT Advisories (fortiguard.fortinet.com)
Related coverage
Other items that share a CVE or were clustered with this one.