Fortinet FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass via Improper Verification of SAML Cryptographic Signature (CVE-2025-59718)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-59718) stems from an improper verification of cryptographic signatures (CWE-347) within Fortinet's authentication framework. When FortiOS, FortiProxy, or FortiSwitchManager processes FortiCloud Single Sign-On (SSO) login requests, it fails to properly validate the cryptographic signature of incoming SAML Response messages from the Identity Provider (IdP). This allows the system to trust unauthenticated, arbitrarily forged SAML assertions.

2. Exploitation Mechanics & Attack Scenario

An attacker targets the FortiCloud SSO login endpoint of an exposed device. By constructing a malicious SAML Response XML document containing arbitrary administrator identity claims—either omitting the signature entirely or signing it with an untrusted key—and sending it to the target, the attacker exploits the lack of signature verification. The vulnerable device accepts the forged assertion as valid, granting the attacker an active administrative session without requiring legitimate credentials.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk. Successful exploitation grants full administrative control over critical network security infrastructure (firewalls, proxies, and switch managers). This can lead to complete network compromise, unauthorized traffic interception, VPN session hijacking, and lateral movement into the internal corporate network.