CVE-2025-62826: Fortinet FortiProxy XSS Vulnerability

CVE-2025-62826 Overview

CVE-2025-62826 is an HTTP Response Splitting vulnerability [CWE-113] affecting Fortinet FortiOS and FortiProxy. The flaw stems from improper neutralization of Carriage Return Line Feed (CRLF) sequences in HTTP headers during captive portal authentication. An attacker positioned to intercept and modify a user's captive portal authentication request can inject arbitrary headers via crafted HTTP requests. Successful exploitation requires user interaction and network-adjacent positioning to intercept traffic. The vulnerability carries a CVSS 3.1 score of 4.3 (Medium) and impacts integrity only, with no direct effect on confidentiality or availability.

Critical Impact
Attackers who intercept captive portal authentication traffic can inject arbitrary HTTP headers, enabling cache poisoning, response manipulation, or downstream client-side attacks against authenticating users.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 (all versions), FortiOS 7.2 (all versions)
Fortinet FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 (all versions), FortiProxy 7.2 (all versions)
Deployments using the captive portal authentication feature

Discovery Timeline

2026-07-14 - CVE-2025-62826 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-62826

Vulnerability Analysis

The vulnerability originates in how Fortinet FortiOS and FortiProxy process HTTP headers during captive portal authentication. The captive portal handler fails to sanitize CRLF (\r\n) sequences supplied through attacker-controlled portions of the authentication request. When these sequences reach the HTTP response construction path, they terminate the current header and begin a new one, allowing arbitrary header injection.

Exploitation requires a Machine-in-the-Middle (MitM) position on the network path between the client and the FortiGate or FortiProxy captive portal. The attacker intercepts the legitimate authentication request, modifies fields that flow into response headers, and forwards the crafted request. The device then reflects the injected CRLF payload back to the user's browser as separate headers.

Because the affected functionality is the captive portal, typical deployments include guest Wi-Fi, hotel networks, and enterprise BYOD onboarding. These environments frequently expose users to hostile local networks where MitM positioning is feasible.

Root Cause

The root cause is missing input validation on user-supplied values used to build HTTP response headers in the captive portal component. The code path does not reject or encode CR (0x0D) and LF (0x0A) characters before writing them into the response stream, violating the guidance codified in CWE-113.

Attack Vector

The attack requires network access, low complexity, no privileges, and user interaction. The attacker must intercept and modify a victim's captive portal authentication request, inject a payload containing CRLF sequences followed by attacker-defined headers, and rely on the user's browser processing the manipulated response. Impact is limited to integrity of the HTTP response, which can enable session fixation, cache poisoning against intermediaries, or delivery of malicious content framed as originating from the trusted captive portal host.

No public proof-of-concept exploit has been published, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-62826

Indicators of Compromise

HTTP requests to captive portal endpoints containing raw or URL-encoded CRLF characters (%0d%0a, \r\n) in query parameters or form fields
Captive portal HTTP responses containing unexpected duplicated headers, Set-Cookie values not issued by the appliance, or injected Location redirects
Anomalous authentication activity originating from network segments where MitM conditions are plausible, such as guest VLANs and open wireless SSIDs

Detection Strategies

Inspect FortiOS and FortiProxy captive portal access logs for authentication requests containing encoded CRLF byte sequences or non-printable characters in parameters
Deploy web application firewall or IPS signatures that flag CRLF injection patterns targeting captive portal URLs
Correlate client-side certificate warnings and unexpected TLS downgrades on captive portal traffic, which can indicate the interception required for exploitation

Monitoring Recommendations

Forward FortiOS and FortiProxy authentication and HTTP proxy logs to a centralized SIEM or data lake for retention and analytics
Baseline normal captive portal request structure and alert on deviations such as oversized parameters, embedded header names, or CRLF encodings
Monitor for repeated failed captive portal authentications from the same source, which may indicate reconnaissance for MitM positioning

How to Mitigate CVE-2025-62826

Immediate Actions Required

Apply the fixed FortiOS and FortiProxy versions referenced in the Fortinet Security Advisory FG-IR-26-153 as soon as change windows permit
Inventory all FortiGate and FortiProxy devices running FortiOS 7.6.0–7.6.4, 7.4.x, or 7.2.x and FortiProxy 7.6.0–7.6.4, 7.4.x, or 7.2.x
Restrict captive portal exposure to trusted network segments where feasible until patching completes

Patch Information

Fortinet has published remediation guidance in advisory FG-IR-26-153. Administrators should upgrade affected FortiOS and FortiProxy branches to the fixed releases listed in the Fortinet PSIRT advisory. Review the advisory for the exact fixed build numbers corresponding to each affected branch.

Workarounds

Disable the captive portal authentication feature on interfaces where it is not strictly required
Enforce HTTPS with valid, pinned certificates for captive portal endpoints and require clients to verify the certificate chain, raising the cost of MitM interception
Segment guest and untrusted networks so that captive portal traffic cannot be intercepted by other clients on the same broadcast domain

bash

# Disable captive portal on a FortiGate interface (example)
config system interface
    edit "guest-wifi"
        set security-mode none
        set explicit-web-proxy disable
    next
end