Search threats, CVEs… ⌘K
Back to vendor advisories
Fortinet PSIRT AdvisoriesFG-IR-26-153

Header injection in captive portal authentication form

CVSSv3 Score: 3.1 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted HTTP requests. Revised on 2026-07-14 00:00:00

Read the vendor bulletin Get alerts for FortiOS
3.1CVSS out of 10Low severity
Scope

What the vendor says is affected

  • FortiOS
  • FortiProxy
Timeline

When this advisory changed

  1. Published by Fortinet

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor
Covers the same product

UI DoS attack

FG-IR-26-162