An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.
2025-10-14T16:15:36.683
2025-10-15T17:33:12.360
Analyzed
CVSSv3.1: 4.8 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Operating System | fortinet | fortios | < 7.0.17 | Yes |
| Operating System | fortinet | fortios | < 7.2.11 | Yes |
| Operating System | fortinet | fortios | < 7.4.7 | Yes |
| Operating System | fortinet | fortios | < 7.6.3 | Yes |