Fortinet FortiOS Flaw Allows MFA Bypass via Invalid Tokens
A broken access control vulnerability in FortiOS allows authenticated attackers with read-only permissions to bypass multi-factor authentication using invalid tokens.
Fortinet has disclosed a significant security vulnerability affecting its FortiOS operating system, specifically within the Remote Radius Type Admin Two-Factor Authentication (TFA) mechanism. The flaw, identified with a CVSSv3 score of 5.9, falls under the category of Improper Authentication (CWE-287).
This vulnerability allows a remote authenticated attacker, who possesses at least read-only permissions on the FortiOS system, to bypass the multi-factor authentication process. The bypass is achievable by presenting an invalid TFA token. This exploit is contingent on a specific interaction with the RADIUS server, where the server must send an "Access-Challenge" response after receiving an invalid TFA token.
When an attacker successfully exploits this vulnerability, they can gain unauthorized access to the FortiOS graphical user interface (GUI). The attack chain involves first entering a valid username and password, which is then followed by the submission of an invalid TFA token. If the RADIUS server responds with the expected "Access-Challenge," the attacker can proceed to log in without providing a valid second factor, effectively circumventing the intended security measure.
The implications of this vulnerability are substantial, as it undermines a critical layer of security designed to protect administrative access. While the attacker must already possess valid user credentials and at least read-only access, the ability to bypass MFA significantly lowers the bar for unauthorized administrative control. This could lead to further compromise of network devices, data exfiltration, or the deployment of malicious configurations.
Fortinet has revised its advisory for this vulnerability on November 10, 2026, indicating that the issue has been identified and potentially addressed. Users of FortiOS are strongly advised to consult the official Fortinet PSIRT advisories for the latest information regarding affected versions, patch availability, and recommended mitigation steps.
Organizations relying on Fortinet devices for their network security infrastructure should prioritize reviewing their authentication configurations. This includes verifying the proper functioning of their RADIUS servers and ensuring that all FortiOS systems are updated to the latest security patches released by Fortinet. Proactive security hygiene is crucial to prevent exploitation of such authentication bypass vulnerabilities.
This discovery highlights the ongoing challenges in securing multi-factor authentication implementations, especially when integrated with complex RADIUS infrastructures. Attackers continually seek to exploit subtle misconfigurations or protocol interactions that can weaken even robust security measures. The specific nature of this bypass, relying on an "Access-Challenge" response, underscores the importance of thoroughly testing authentication flows in diverse network environments.