FortiOS RADIUS 2FA Authentication flaw allows login with invalid token after valid credentials
A security vulnerability (CWE-287) in FortiOS affects the Remote Radius Type Admin authentication, which could permit a remote authenticated attacker with read-only permissions to log in using an invalid token after entering valid username and password, particularly when the RADIUS server responds with an 'Access-Challenge' following an invalid two-factor authentication token. To mitigate, administrators are advised to remove the Remote Radius Type Admin account linked to such RADIUS servers by navigating the GUI to System > Administrators and deleting the relevant accounts, or via CLI with 'config system admindelete'. Fortinet published this initial advisory on November 10, 2026, and additional documentation is available for configuration and management of remote authentication.
Entenda a falha
A vulnerabilidade
An Improper Authentication flaw (CWE-287) in FortiOS, in the Remote Radius Type Admin two-factor (TFA) authentication. A remote attacker who is authenticated with at least read-only permission and knows a valid username and password can log in to the FortiOS GUI with an invalid token. This only happens when the RADIUS server returns an extra "Access-Challenge" response after an invalid TFA token. No CVE is listed, and the articles give no affected or fixed versions. Fortinet published advisory FG-IR-26-195 on 2026-11-10.
Como funciona
An administrator defined as a Remote Radius Type Admin logs in to the FortiOS GUI with a username, password and a two-factor token, and FortiOS relies on the RADIUS server to validate them. When the token is invalid, some RADIUS servers answer with an additional "Access-Challenge" message instead of a plain rejection. In that scenario FortiOS ends up granting GUI access even though the token was not valid, so the second factor is not enforced.
Por que é vulnerável
The advisory classifies it as improper authentication: the handling of the RADIUS Access-Challenge reply that follows a failed TFA token does not lead to a denial of login. The articles do not describe the exact code logic, why it went unnoticed or what a patch changes. The only mitigation Fortinet gives is removing the affected admin accounts.
Como foi descoberta
The articles do not say who found the flaw or how. They only say that Fortinet published the initial advisory FG-IR-26-195 on 2026-11-10 through its PSIRT.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 09:40.
Linha do tempo
-
FortiOS RADIUS 2FA Authentication flaw allows login with invalid token after valid credentials
ler a análise desta fonte ocultar
A security vulnerability (CWE-287) in FortiOS affects the Remote Radius Type Admin authentication, which could permit a remote authenticated attacker with read-only permissions to log in using an invalid token after entering valid username and password, particularly when the RADIUS server responds with an 'Access-Challenge' following an invalid two-factor authentication token. To mitigate, administrators are advised to remove the Remote Radius Type Admin account linked to such RADIUS servers by navigating the GUI to System > Administrators and deleting the relevant accounts, or via CLI with 'config system admindelete'. Fortinet published this initial advisory on November 10, 2026, and additional documentation is available for configuration and management of remote authentication.