BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
SECURITY ADVISORYFORTINETVERIFIED

PUBLISHER UPDATE · FORTINET-PRODUCTS-F79843186AAA32C9

FORTINET-PRODUCTS-F79843186AAA32C9 release notes and known issues

JWT used for authentication in web GUI signed with static key

Scope: Fortinet products. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

CVSSv3 Score: 9.6 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00

Improvements and security content

  • CVSSv3 Score: 9.6 An Inclusion of Sensitive Information in Source Code vulnerability [CWE-540] in FortiMonitorOnSight web portal may allow a remote unauthenticated attacker to bypass authentication via forged or reused JWT Revised on 2026-09-08 00:00:00

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Fortinet products

Affected versions

  • 9.6

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Official publisher evidence

FORTINETVERIFIED

JWT used for authentication in web GUI signed with static key

Checked 10 Oct 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source