An improper authentication flaw allows an attacker who has captured a two‑factor authentication request to replay it and bypass authentication. This flaw enables unauthenticated access to FortiSOAR services, potentially granting full control without the need to guess credentials or exploit other vulnerabilities. The weakness is categorized as CWE‑287, indicating an authentication bypass issue.

Fortinet FortiSOAR PaaS versions 7.5.0 through 7.5.2 and 7.6.0 through 7.6.3, as well as FortiSOAR on‑premise versions 7.5.0 through 7.5.2 and 7.6.0 through 7.6.3 are affected. Users running any of these versions are at risk if no updates have been applied.

The CVSS base score of 6.7 reflects moderate severity. The attack requires the adversary to intercept, decrypt, and precisely time the replay of authentication traffic before the two‑factor token expires, raising attack complexity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, so the overall risk is moderate pending remediation.