Vulnerability Summary
- Vulnerability Name: Fortinet FortiWeb SAML Authentication Bypass
- CVE ID: CVE-2025-59719
- CVSS Score: 9.8
- Severity: Critical
- Vulnerability Type: Authentication Bypass
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Exploitability: High (unauthenticated and remotely exploitable)
- Affected Feature: FortiCloud Single Sign-On (SAML)
- Patch Available: Yes
Overview
Fortinet has addressed a critical authentication bypass vulnerability in its FortiWeb Web Application Firewall product. Tracked as CVE-2025-59719, this issue allows an attacker to bypass FortiCloud Single Sign-On (SSO) authentication entirely and gain unauthorized access to FortiWeb systems.
The vulnerability is especially dangerous because it does not require valid credentials, does not require user interaction, and can be exploited remotely. Any FortiWeb deployment using the affected SAML-based SSO functionality should be considered exposed until patched.
What Caused the Issue
The vulnerability is rooted in how FortiWeb processes SAML authentication responses when FortiCloud SSO is enabled. FortiWeb does not properly validate the cryptographic signature included in the SAML response.
Because this verification step is incomplete, FortiWeb may accept a forged or manipulated SAML assertion as legitimate. This allows an attacker to impersonate an authenticated user without access to the identity provider or valid login credentials.
This weakness exists in the authentication logic itself, which means network-level protections alone are not sufficient to prevent exploitation.
How the Vulnerability Can Be Exploited
An attacker can exploit CVE-2025-59719 by crafting a malicious SAML response and sending it directly to the FortiWeb SSO login endpoint.
Due to the flawed signature validation:
- The forged response is treated as trusted
- Authentication checks are bypassed
- The attacker gains authenticated access
The process does not require any interaction from a legitimate user, and no prior access to the system is needed. This makes exploitation straightforward once a vulnerable FortiWeb instance is reachable.
Impact and Risk
If exploited, this vulnerability allows attackers to bypass FortiWeb’s authentication controls completely. The impact can include:
- Unauthorized access to FortiWeb administrative interfaces
- Modification of security rules and firewall policies
- Exposure of applications protected by FortiWeb
- Potential interception or manipulation of web traffic
- Weakening or disabling of web application firewall protections
Because FortiWeb often sits in front of critical web services, compromise of this component can have a wider effect on application security and availability.
Affected FortiWeb Versions
The following FortiWeb versions are vulnerable to CVE-2025-59719:
- FortiWeb 8.0.0
- FortiWeb 7.6.0 through 7.6.4
- FortiWeb 7.4.0 through 7.4.9
Deployments running any of these versions with FortiCloud SSO enabled are at risk.
Which Versions You Should Upgrade To
Fortinet has released fixed versions that correct the SAML signature verification logic. Organizations should upgrade based on their current release branch:
- If running FortiWeb 8.0.x → upgrade to 8.0.1 or later
- If running FortiWeb 7.6.x → upgrade to 7.6.5 or later
- If running FortiWeb 7.4.x → upgrade to 7.4.10 or later
Upgrading within the same major release branch helps minimize compatibility issues while ensuring the vulnerability is fully resolved.
Official Patch Reference
Fortinet has published an official security advisory and firmware updates addressing CVE-2025-59719.
Fortinet PSIRT Advisory:
https://fortiguard.fortinet.com/psirt/FG-IR-25-647
This advisory includes:
- Confirmation of the vulnerability
- Affected and fixed FortiWeb versions
- Official remediation guidance
Administrators should rely on this source for firmware downloads and validation.
How to Apply the Patch
For self-managed FortiWeb deployments, patching typically involves:
- Identifying the currently installed FortiWeb version
- Downloading the appropriate fixed firmware version from Fortinet
- Backing up the existing configuration
- Applying the firmware update
- Verifying the system version and functionality after reboot
After upgrading, administrators should confirm that FortiCloud SSO authentication behaves as expected and that administrative access is properly restricted.
Temporary Mitigation If Patching Is Delayed
If an immediate upgrade is not possible, organizations should temporarily disable FortiCloud SSO to remove the vulnerable authentication path. This reduces exposure but does not address the underlying flaw.
Disabling SSO should only be considered a short-term measure until the official patch is applied.
Final Takeaway
CVE-2025-59719 represents a critical authentication bypass vulnerability with a very low barrier to exploitation. Because it allows unauthenticated attackers to gain access to FortiWeb systems, it poses a direct threat to the security of protected applications and infrastructure.
Organizations using affected FortiWeb versions should treat this issue as high priority, apply the official Fortinet patches as soon as possible, and review authentication configurations to ensure secure operation.
