CVE-2024-52965

A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.

Scoring

Severity

MEDIUM

CVSS base score

6.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

EPSS probability

0.26%

CWE

CWE-304

Published

2025-07-08

Last modified

2026-03-13

Affected products

• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiProxy

Weakness type

• CWE-304

Related vulnerabilities

• CVE-2023-54391 — Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
• CVE-2026-59564 — Authentication bypass between ZCC and client connector portal
• CVE-2026-76207 — phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
• CVE-2026-49467 — TOTP enrollment hijack: password gate skipped due to unawaited promise
• CVE-2026-61466 — Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
• CVE-2026-67351 — Serendipity < 2.6.1 Authentication Bypass via Username Collision
• CVE-2026-55957 — Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
• CVE-2026-57915 — Apache Kerby: Kerberos Pre-Authentication Bypass

Markdown version · Browse all CVEs