---
id: CVE-2025-59719
title: >-
  An improper verification of cryptographic signature vulnerability in Fortinet
  FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may
  allow an unauthenticated attacker to bypass the FortiCloud SSO login
  authenticat…
summary: >-
  An improper verification of cryptographic signature vulnerability in Fortinet
  FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may
  allow an unauthenticated attacker to bypass the FortiCloud SSO login
  authenticat…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-347
vendor: Fortinet
product: FortiWeb
affected:
  - FortiWeb 8.0.0
  - FortiWeb >= 7.6.0 <= 7.6.4
  - FortiWeb >= 7.4.0 <= 7.4.9
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2025-12-10T04:57:28.019701Z'
published: '2025-12-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:09:27.957Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-59719'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-25-647'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-25-647'
tags:
  - cve.org
epss: 0.29224
epssPercentile: 0.98152
ingestedAt: '2026-10-15T05:52:46.067Z'
---

## Overview

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

## Affected

- `FortiWeb 8.0.0`
- `FortiWeb >= 7.6.0 <= 7.6.4`
- `FortiWeb >= 7.4.0 <= 7.4.9`

## Remediation

Upgrade to FortiSwitchManager version 7.2.7 or above
Upgrade to FortiSwitchManager version 7.0.6 or above
Upgrade to FortiProxy version 7.6.4 or above
Upgrade to FortiProxy version 7.4.11 or above
Upgrade to FortiProxy version 7.2.15 or above
Upgrade to FortiProxy version 7.0.22 or above
Upgrade to FortiOS version 7.6.4 or above
Upgrade to FortiOS version 7.4.9 or above
Upgrade to FortiOS version 7.2.12 or above
Upgrade to FortiOS version 7.0.18 or above
Upgrade to FortiWeb version 8.0.1 or above
Upgrade to FortiWeb version 7.6.5 or above
Upgrade to FortiWeb version 7.4.10 or above
Fortinet remediated this issue in FortiSASE version 25.3.b and hence customers do not need to perform any action.
Upgrade to FortiPAM version 1.8.0 or above