CVE-2018-9186: Fortinet Fortiauthenticator

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header.

Affected products

• Fortinet Fortiauthenticator: from 4.0.0, before 5.3.0 (fixed in 5.3.0)

Published 2018-05-31. Last modified 2026-06-17.