FortiSOAR 2FA Bypass: Replay Attack Raises Authentication Concerns

The National Vulnerability Database (NVD) has disclosed CVE-2026-23708, detailing an improper authentication vulnerability affecting Fortinet FortiSOAR PaaS (versions 7.6.0-7.6.3 and 7.5.0-7.5.2) and FortiSOAR on-premise (versions 7.6.0-7.6.3 and 7.5.0-7.5.2). This vulnerability, rated with a CVSS score of 7.5 (HIGH), could allow an unauthenticated attacker to bypass two-factor authentication (2FA).

The attack vector, categorized as CWE-287 (Improper Authentication), involves an attacker intercepting and decrypting authentication traffic. They can then replay a captured 2FA request. The NVD notes that successful exploitation requires precise timing, as the replay must occur before the token expires, increasing the attack’s complexity. However, ‘high complexity’ doesn’t mean ‘impossible,’ especially for determined adversaries with sufficient resources and network access.