An improper authentication flaw allows an attacker who has captured a two‑factor authentication request to replay it and bypass authentication. This flaw enables unauthenticated access to FortiSOAR services, potentially granting full control without the need to guess credentials or exploit other vulnerabilities. The weakness is categorized as CWE‑287 for authentication bypass and CWE‑862 for authorization control weaknesses, highlighting improper validation of authentication states.

Fortinet FortiSOAR PaaS versions 7.5.0 through 7.5.2 and 7.6.0 through 7.6.3, as well as FortiSOAR on‑premise versions 7.5.0 through 7.5.2 and 7.6.0 through 7.6.3 are affected. Users running any of these versions are at risk if no updates have been applied.

The CVSS base score of 6.7 reflects moderate severity. The attack requires the adversary to intercept, decrypt, and precisely time the replay of authentication traffic before the two‑factor token expires, raising attack complexity. The EPSS score of 0.00066 indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so the overall risk is moderate pending remediation.