{"id":"CVE-2024-52965","aliases":["EUVD-2024-54757","GHSA-3jrw-g6mq-cx56"],"status":"published","title":"A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6...","description":"A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 \u0026 FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00296,"percentile":0.22547,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-304"],"published":"2025-07-08T14:41:38Z","modified":"2026-06-17T08:07:56Z","products":[{"vendor":"fortinet","product":"fortios"},{"vendor":"fortinet","product":"fortiproxy"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-511","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52965"},{"url":"https://github.com/advisories/GHSA-3jrw-g6mq-cx56"}],"sources":{"cve":[{"id":"CVE-2024-52965","description":"A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 \u0026 FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.","status":"published","published":"2025-07-08T14:41:38.347Z","modified":"2025-07-08T20:41:57.917Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-304"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2024-54757","description":"A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 \u0026 FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.","status":"published","published":"2025-07-08T14:41:38Z","modified":"2025-07-08T20:41:57Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","level":"medium"}],"updated_at":"2026-11-02T20:32:10.524333Z"}],"ghsa":[{"id":"GHSA-3jrw-g6mq-cx56","title":"A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6...","description":"A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 \u0026 FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.","status":"published","published":"2025-07-08T15:32:03Z","modified":"2025-07-08T15:32:10Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-304"],"updated_at":"2026-11-02T15:02:56.619633Z"}],"nvd":[{"id":"CVE-2024-52965","description":"A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 \u0026 FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.","status":"published","published":"2025-07-08T15:15:22.313Z","modified":"2026-06-17T08:07:56.423Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-304"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}