CVE-2025-59719FortiWeb FortiCloud SSO SAML bypass
What broke
FortiWeb accepted a crafted FortiCloud SSO SAML message the same way FortiOS did in CVE-2025-59718. CWE-347, CVSS 9.8, disclosed 9 December 2025. CISA's KEV addition named 59718 first. Do not read that as "FortiWeb is fine."
Why it matters
WAF management planes are a favorite place to hide. A FortiWeb admin session can change inspection policy, plant allow-lists, and cover the next stage. Pair this with CVE-2025-64446 (FortiWeb auth bypass / path traversal, also on KEV) and you have two independent ways onto the same box.
What to do
- Patch FortiWeb and disable FortiCloud SSO if you do not use it.
- Audit FortiWeb admin accounts and policy diffs from mid-December 2025.
- Apply the later CVE-2026-24858 fix. Devices patched only for 59718/59719 stayed exposed.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
- NVD: CVE-2025-59719
- Fortinet PSIRT advisories for FortiCloud SSO
Related identity CVEs
Related on Start with Identity
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- CVEruby-saml auth bypass, incomplete fix of CVE-2025-25292
The March 2025 ruby-saml patch did not close the parser differential. CVE-2025-54572 is the incomplete-fix follow-on: still a critical SSO impersonation if you
- CVECisco SAML 2.0 mixes authorization domains
Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The pr
- CVEGitHub Enterprise Server SAML bypass via libxml2 canonicalization
GitHub Enterprise Server accepted a crafted SAML response because libxml2 canonicalization quirks let the signed XML and the consumed XML diverge. High-severity
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.