CVE-2025-59719FortiWeb FortiCloud SSO SAML bypass
What broke
FortiWeb accepted a crafted FortiCloud SSO SAML message the same way FortiOS did in CVE-2025-59718. CWE-347, CVSS 9.8, disclosed 9 December 2025. CISA's KEV addition named 59718 first. Do not read that as "FortiWeb is fine."
Why it matters
WAF management planes are a favorite place to hide. A FortiWeb admin session can change inspection policy, plant allow-lists, and cover the next stage. Pair this with CVE-2025-64446 (FortiWeb auth bypass / path traversal, also on KEV) and you have two independent ways onto the same box.
What to do
- Patch FortiWeb and disable FortiCloud SSO if you do not use it.
- Audit FortiWeb admin accounts and policy diffs from mid-December 2025.
- Apply the later CVE-2026-24858 fix. Devices patched only for 59718/59719 stayed exposed.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
- NVD: CVE-2025-59719
- Fortinet PSIRT advisories for FortiCloud SSO
Related identity CVEs
Related on Start with Identity
- GlossaryIdentity Federation
Identity federation is a trust arrangement in which one party, the [identity provider](/glossary/identity-provider/), authenticates a user and another party, th
- GlossarySSO Identifier (SSO ID)
An SSO identifier, or SSO ID, is the value an identity provider sends to an application to say which user just signed in: the `NameID` in a [SAML](/glossary/sam
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- CVEruby-saml auth bypass, incomplete fix of CVE-2025-25292
The March 2025 ruby-saml patch did not close the parser differential. CVE-2025-54572 is the incomplete-fix follow-on: still a critical SSO impersonation if you
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.