Critical Fortinet Flaw Risks Unauthenticated Admin Bypass via FortiCloud SSO SAML Forgery

Fortinet has issued an urgent security advisory about a critical vulnerability that could allow unauthenticated attackers to bypass FortiCloud Single Sign-On and potentially gain admin access via a forged SAML token, a flaw rated 9.1 on the CVSS scale. The issue, tracked as CVE-2025-59718 and CVE-2025-59719, is described as an Improper Verification of Cryptographic Signature (CWE-347) affecting multiple Fortinet product lines, including FortiOS, FortiWeb, FortiProxy and FortiSwitch Manager.

According to the advisory, an unauthenticated attacker may bypass the FortiCloud SSO login authentication if the feature is enabled on the device, by forging a security token the system accepts as valid. Fortinet notes that the FortiCloud SSO login feature is not enabled by default, but it can be automatically enabled during device registration, creating a potential exposure for many organisations.

Patches have been released, with upgrade paths listed for FortiOS, FortiProxy, FortiWeb and FortiSwitch Manager, and a mitigation to disable FortiCloud login temporarily if patching cannot be applied immediately. The command provided to disable the feature is config system global set admin-forticloud-sso-login disable end, and administrators are urged to upgrade as soon as possible. 10 December 2025.