CVE-2025-48840CWE-290

An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb…

Medium · published March 10, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow a remote unauthenticated attacker to bypass hostname restrictions via a specially crafted request.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-03-10T16:44Z
EPSS history
Timeline
  • 10 MAR 16:44Z
    An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.8, FortiWeb 7.2 all versions, FortiWeb…
    cvelistv5