CVE-2025-59808: Fortinet FortiSOAR Auth Bypass Vulnerability

CVE-2025-59808 Overview

CVE-2025-59808 is an unverified password change vulnerability [CWE-620] affecting Fortinet FortiSOAR in both PaaS and on-premise deployments. An attacker who has already gained access to a victim's user account can reset the account credentials without being prompted to confirm the current password. This allows the attacker to lock out the legitimate user and establish persistent access using new credentials of their choice. The flaw affects FortiSOAR versions 7.3 through 7.6.2 across multiple release branches.

Critical Impact
Attackers with existing session access can permanently take over FortiSOAR accounts by resetting passwords without verifying the current one, enabling persistence and lockout of legitimate users.

Affected Products

Fortinet FortiSOAR PaaS 7.3 (all versions), 7.4 (all versions), 7.5.0 through 7.5.1, 7.6.0 through 7.6.2
Fortinet FortiSOAR on-premise 7.3 (all versions), 7.4 (all versions), 7.5.0 through 7.5.1, 7.6.0 through 7.6.2
FortiSOAR administrative and analyst user accounts across both deployment models

Discovery Timeline

2025-12-09 - CVE-2025-59808 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59808

Vulnerability Analysis

The vulnerability resides in the password change workflow of FortiSOAR. Under normal secure design, changing an account password requires the requester to supply the current password as proof of possession. FortiSOAR omits this verification step, allowing any authenticated session tied to a user account to submit a new password directly.

This weakness maps to CWE-620 (Unverified Password Change). It effectively converts a temporary session compromise, such as a stolen session token, a shared workstation, or a phished browser session, into permanent account ownership. The attacker can rotate the credential and evict the original user.

FortiSOAR is a Security Orchestration, Automation, and Response (SOAR) platform. Account takeover in this context is particularly consequential because SOAR accounts often hold privileges to execute playbooks, query connected security tools, and interact with production incident response workflows.

Root Cause

The root cause is missing re-authentication logic in the password change endpoint. The application trusts the presence of an active authenticated session as sufficient authorization for a credential modification, rather than requiring the user to prove knowledge of the existing password. This violates defense-in-depth principles for sensitive account operations.

Attack Vector

Exploitation requires the attacker to already control an authenticated FortiSOAR session. Common preconditions include stolen session cookies, hijacked browser sessions, credential reuse, or physical access to an unlocked workstation. Once a session is available, the attacker sends a password change request over the network without supplying the current password. The server accepts the change and the attacker retains access using the new credentials while the legitimate user is locked out.

The vulnerability is exploited entirely over the network against the FortiSOAR web interface or API and does not require user interaction from the victim beyond the initial session compromise.

No verified public exploit code is available. See the Fortinet Security Advisory FG-IR-25-599 for vendor-supplied technical details.

Detection Methods for CVE-2025-59808

Indicators of Compromise

Password change events in FortiSOAR audit logs that are not preceded by a user-initiated forgotten-password flow or administrative reset
Successful logins from new or unusual source IP addresses immediately following a password change event
User complaints of unexpected lockouts or credentials no longer working after a valid session
Session activity from geolocations or user agents that deviate from the account's normal baseline

Detection Strategies

Correlate FortiSOAR authentication and account management events to flag password changes that occur without a preceding password reset request or administrator action
Monitor for password changes performed from a session whose source IP or user agent differs from the session that originally authenticated the account
Alert on rapid sequences of session creation followed by credential modification followed by administrative playbook execution

Monitoring Recommendations

Forward FortiSOAR audit and authentication logs to a centralized SIEM for long-term retention and correlation
Enable alerting on all privileged account password changes and require analyst review
Track SOAR playbook execution by account to identify unexpected activity following credential modifications

How to Mitigate CVE-2025-59808

Immediate Actions Required

Upgrade FortiSOAR to a fixed release as specified in the Fortinet advisory FG-IR-25-599
Force password rotation for all FortiSOAR user accounts and invalidate active sessions after patching
Review recent password change events across all accounts and validate them with the account owners
Audit administrative playbooks and connector credentials for signs of unauthorized modification

Patch Information

Fortinet has published remediation guidance in Fortinet Security Advisory FG-IR-25-599. Administrators should consult the advisory for the specific fixed build numbers corresponding to each affected release branch (7.3, 7.4, 7.5, and 7.6) and for both PaaS and on-premise deployments.

Workarounds

Restrict network access to the FortiSOAR management interface to trusted administrative networks using firewall rules or VPN gating
Enforce multi-factor authentication on all FortiSOAR accounts to raise the cost of initial session compromise
Reduce session lifetimes and enable idle session timeouts to shrink the window in which a hijacked session can be abused
Limit privileged account usage to dedicated workstations that are not used for email or general web browsing

bash

# Configuration example: restrict FortiSOAR management access at the network edge
# Replace 10.0.0.0/24 with your administrative network range
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP