An authentication bypass flaw allows an attacker who knows an administrator's password to circumvent multifactor authentication by sending multiple crafted requests. The flaw is an example of a privilege escalation vulnerability where valid credentials can be abused to bypass security checks. The resulting loss of authentication integrity can lead to unauthorized system access and potential data compromise.

Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, and 7.2.2 through 7.2.11, as well as FortiManager versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, and 7.2.2 through 7.2.11 are affected. The vulnerability is tied to the firmware and system software in these product lines.

The CVSS score of 6.8 places this as a medium severity issue, but the low EPSS score (< 1%) indicates a small chance of current exploitation. It is not listed in CISA’s KEV catalog. The attack vector requires knowledge of an admin password and the ability to send crafted HTTP requests to the management interface. The threat grows if the system is exposed to untrusted or semi‑trusted traffic, as the bypass can be enacted without additional authentication. Until patched, exposed devices should be isolated or access restricted until the vulnerability is mitigated.