Critical vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719, CVE-2026-24858 exploited in the wild

Overview Update for CVE-2026-24858: On January 27, 2026, Fortinet disclosedCVE-2026-24858 , a critical unauthenticated vulnerability allowing authentication bypass via Fortinet’s cloud SSO. Confirmed as a net-new vulnerability rather than a patch bypass, it has beenobserved under active zero-day...

dj-rest-auth-mfa (>=0.0.2, <=0.0.3), dj-rest-auth-saml (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2025-65430 via django-allauth (0.57.0)

django-allauth PYPI version 0.57.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - dj-rest-auth-mfa =0.0.2, =0.0.1, =0.28.0, =0.35.0 Source cves: CVE-2025-65430 Source advisory: OSV:GHSA-QHMC-3MVR-F2J4...

dj-rest-auth-mfa (>=0.0.2, <=0.0.3), dj-rest-auth-saml (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2025-65431 via django-allauth (0.57.0)

django-allauth PYPI version 0.57.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - dj-rest-auth-mfa =0.0.2, =0.0.1, =0.28.0, =0.35.0 Source cves: CVE-2025-65431 Source advisory: OSV:GHSA-8M3C-C723-H4P4...

dj-rest-auth-mfa (>=0.0.2, <=0.0.3), dj-rest-auth-saml (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2025-65430 via django-allauth (0.57.0)

django-allauth PYPI version 0.57.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - dj-rest-auth-mfa =0.0.2, =0.0.1, =0.28.0, =0.35.0 Source cves: CVE-2025-65430 Source advisory: OSV:PYSEC-2025-110...

dj-rest-auth-mfa (>=0.0.2, <=0.0.3), dj-rest-auth-saml (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2025-65431 via django-allauth (0.57.0)

django-allauth PYPI version 0.57.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - dj-rest-auth-mfa =0.0.2, =0.0.1, =0.28.0, =0.35.0 Source cves: CVE-2025-65431 Source advisory: OSV:PYSEC-2025-111...

VulnCheck KEV: CVE-2025-59718

Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML message. Please be aware that CVE-2025-59719...

CVE-2025-54369

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...

Authentication Bypass

ruby-saml is vulnerable to authentication bypass. The vulnerability is due to improper handling of libxml2 canonicalization in Nokogiri when processing invalid XML, which returns an empty string used for DigestValue calculation, allowing an attacker to perform a Signature Wrapping attack and bypa...

Authentication Bypass

ruby-saml is vulnerable to authentication bypass. The vulnerability is due to inconsistent XML parsing between REXML and Nokogiri resulting in different document structures, which allows an attacker to perform a Signature Wrapping attack and bypass authentication...

CVE-2025-54369 Node-SAML SAML Authentication Bypass

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...

CVE-2025-54369: Improper Neutralization of Alternate XSS Syntax

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...

Linux Distros Unpatched Vulnerability : CVE-2025-66567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypas...

Linux Distros Unpatched Vulnerability : CVE-2025-66568

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through...

CVE-2025-59719

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.1.0-beta.2), org.keycloak:keycloak-account-freemarker (1.2.0.final) +9 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (1.2.0.final)

org.keycloak:keycloak-services MAVEN version 1.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.1.0-beta.2 -...

org.keycloak:keycloak-account-freemarker (1.2.0.cr1), org.keycloak:keycloak-broker-oidc (1.2.0.cr1) +8 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (1.2.0.cr1)

org.keycloak:keycloak-services MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.2.0.cr1 - org.keycloak:keycloak-broker-oidc 1.2.0.cr...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-beta.3, <=1.1.3.final), org.keycloak:keycloak-account-freemarker (1.3.1.final) +9 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (1.3.1.final)

org.keycloak:keycloak-services MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-beta.3, =1.1.3.final -...

org.keycloak:keycloak-account-freemarker (1.6.1.final), org.keycloak:keycloak-broker-oidc (1.6.1.final) +9 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (1.6.1.final)

org.keycloak:keycloak-services MAVEN version 1.6.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.6.1.final - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.4.0.final), org.keycloak:keycloak-broker-oidc (1.4.0.final) +8 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (1.4.0.final)

org.keycloak:keycloak-services MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.4.0.final - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.5.1.final), org.keycloak:keycloak-broker-oidc (1.5.1.final) +8 more potentially affected by CVE-2025-14082 via org.keycloak:keycloak-services (1.5.1.final)

org.keycloak:keycloak-services MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.5.1.final - org.keycloak:keycloak-broker-oidc...