CVE-2025-59719

The attacker sends a crafted SAML response message that is not properly verified for cryptographic signature by vulnerable versions of FortiWeb. Since FortiWeb accepts an unsigned or improperly signed SAML response, the attacker can impersonate any user, including an administrator, and gain access to the management panel without knowledge of authentication credentials. The attack requires no privileges or user interaction, and the network vector means it can be conducted remotely.

An unauthenticated attacker can gain full control over the FortiWeb management interface, potentially resulting in configuration disclosure, modification of WAF security rules, and threats to the availability of protected infrastructure.

Apply patches available from the vendor according to the references (https://fortiguard.fortinet.com/psirt/FG-IR-25-647). Until the update is applied, it is recommended to restrict access to the management interface and disable authentication via FortiCloud SSO if not essential.

Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 – 7.6.4, FortiWeb 7.4.0 – 7.4.9