DEV Community

Anoymask
Anoymask

Posted on

Fortinet CVE-2026-84390 and CVE-2026-84388: JWT Authentication Bypass and Browser Traffic Proxying

#security #threatintel

1. Basic Information

2. Executive Summary

Fortinet fixed a JWT authentication bypass in FortiMonitorOnSight and an extension flaw that can route browser traffic through attacker-controlled servers after a malicious website visit. These are separate vulnerabilities with different products and prerequisites.

3. Attack Flow

CVE-2026-84390: JWT authentication bypass described by Fortinet PSIRT

  1. Affected FortiMonitorOnSight installations use a static key to sign JWTs for web GUI authentication.
  2. A remote unauthenticated attacker submits a forged or reused JWT to the portal.
  3. If accepted, the token may bypass authentication and permit access to protected functionality.

CVE-2026-84388: Extension path described by Fortinet PSIRT

  1. An attacker directs a user of the affected extension to a malicious website.
  2. Improper authentication in the extension may allow a remote unauthenticated attacker to proxy the user’s browser traffic through attacker-controlled servers.

4. Attacker Position and Execution Environment

  • CVE-2026-84390 involves an external attacker who can reach the portal. CVE-2026-84388 involves a separate path: directing a user of the vulnerable extension to a malicious website.

5. What Users and Administrators May See

Users

  • Browsing a website is the entry condition for the extension path. A victim click is not described as a prerequisite for the JWT path.

Administrators

  • Inference: Suspicious portal access and browser-traffic changes belong to different products and endpoints and should be investigated separately.

6. Success Conditions and Risk Reduction

Success Conditions

  • The JWT path requires a reachable, affected FortiMonitorOnSight installation that accepts the attacker’s token.
  • The extension path requires a malicious website to be opened in an affected browser configuration. Do not combine the two vulnerabilities into one chain.

Failure Conditions and Risk Reduction

  • Update affected FortiMonitorOnSight versions 7.2.0 through 7.2.2 or 7.2.4 through 7.2.7 to 7.2.8 or later.
  • Update FortiPAM to 1.9.1 or 1.8.4 and the Chrome extension to 8.0.1.123 or later. Fortinet states that both components must be updated.

7. Potential Impact

  • FortiMonitorOnSight authentication bypass under the conditions described by Fortinet.
  • Browser traffic proxied through attacker-controlled servers. Fortinet classifies the impact as information disclosure, but this does not establish observed interception of all traffic or credential theft.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

  • Email: Review lure emails if they led to extension exploitation. Email is not required for the JWT path.
  • Proxy/SWG/DNS: Review visits to malicious sites and proxied traffic. JWT contents are visible only where decryption and logging permit inspection.
  • Endpoint/EDR: Check the extension ID and version, browser configuration, and FortiPAM-related settings. Visibility into extension internals depends on the product.
  • Identity/IdP: Link FortiMonitorOnSight authentication outcomes to protected operations. Distinguish token submission from token acceptance.
  • SaaS/Cloud: Review monitoring-platform and privileged-access audit records, choosing sources appropriate to SaaS or on-premises deployment.
  • Network: Investigate portal connection sources separately from changes to browser-traffic destinations and routes.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation, not claims that each stage occurred. See Facts and Unknowns for the reported scope.

  • Attempt observed (success unconfirmed): Evidence criterion: Confirm invalid-token submission to the portal or contact with a malicious site.
  • User interaction confirmed: Evidence criterion: Confirm site browsing for the extension path. Do not apply that click prerequisite to the JWT path.
  • Initial execution confirmed: Evidence criterion: Confirm processing following token acceptance or unauthorized proxying by the extension. Ordinary page display is insufficient.
  • Malware execution or authentication success confirmed: Evidence criterion: For CVE-2026-84390, require evidence of protected operations performed without legitimate authentication.
  • Data theft or session compromise confirmed: Evidence criterion: Distinguish traffic forwarded through a proxy path from confirmed disclosure of sensitive content.
  • Follow-on compromise confirmed: Evidence criterion: Require additional evidence for configuration changes or access to other systems following the bypass.

10. Investigation Playbook

Inference: Operational recommendations based on the described behavior.

  • Trigger: Suspicious portal activity using a JWT, or a browser-traffic route change after visiting a malicious website.
  • Initial Checks: Separate the CVEs and verify versions and exposure for FortiMonitorOnSight, FortiPAM, and the extension.
  • Endpoint: Check the extension ID and version, browser configuration, and FortiPAM-related settings. Visibility into extension internals depends on the product.
  • Identity and Cloud: Link FortiMonitorOnSight authentication outcomes to protected operations. Distinguish token submission from token acceptance. Review monitoring-platform and privileged-access audit records, choosing sources appropriate to SaaS or on-premises deployment.
  • Follow-on Activity: Require additional evidence for configuration changes or access to other systems following the bypass.
  • Containment: Patch the affected products and extension and restrict portal access where appropriate. Assess operational impact before temporarily disabling an extension used for privileged access.
  • Classification: Distinguish contact, execution, abuse of privileges, data collection, and follow-on compromise using evidence. Missing logs do not prove that compromise did not occur.

11. Defense and Detection Ideas

Inference: Operational recommendations based on the described behavior.

  • Single Event: Suspicious portal activity using a JWT, or a browser-traffic route change after visiting a malicious website.
  • Time-Series Correlation: For the JWT path, trace request, authentication result, and protected operation. For the extension path, trace browsing, extension activity, and proxy traffic separately.
  • Threat Hunting: Inventory unpatched portals and extensions, then investigate suspicious access or traffic changes for each.
  • Logging Gaps: Check the extension ID and version, browser configuration, and FortiPAM-related settings. Visibility into extension internals depends on the product. Investigate portal connection sources separately from changes to browser-traffic destinations and routes.
  • Priority Controls: Update affected FortiMonitorOnSight versions 7.2.0 through 7.2.2 or 7.2.4 through 7.2.7 to 7.2.8 or later. Update FortiPAM to 1.9.1 or 1.8.4 and the Chrome extension to 8.0.1.123 or later. Fortinet states that both components must be updated.

12. Facts / Inference / Hypothesis

Facts

  • Fortinet’s FG-IR-26-170 describes CVE-2026-84390 (CVSS 9.6) as the use of a static key to sign JWTs for web GUI authentication. A JWT is a signed token carrying authentication information in this context. Sensitive information embedded in source code (CWE-540) may allow a remote unauthenticated attacker to bypass authentication using forged or reused JWTs.
  • Affected FortiMonitorOnSight versions are 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7; the fixed release is 7.2.8 or later. FG-IR-26-170 was published on September 8, 2026, and lists known exploitation as “No.”
  • Fortinet’s FG-IR-26-168 describes CVE-2026-84388 (CVSS 9.1) as improper authentication (CWE-287) in the Privileged Access Agent Chrome extension. If a user visits a malicious website, a remote unauthenticated attacker may be able to proxy the user’s browser traffic through attacker-controlled servers.
  • A complete fix for CVE-2026-84388 requires updating FortiPAM to 1.9.1 or 1.8.4 and the Chrome extension to 8.0.1.123 or later. FG-IR-26-168 directs users of extension branch 7.4 to migrate to a fixed release and users of branch 8.0 to update to 8.0.1.123 or later.
  • FG-IR-26-168 was published on September 8, 2026, and lists known exploitation as “No.”

Inference

  • The investigation, success-assessment, and defense recommendations are derived from public information. They are not observations of real-world compromise.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (high confidence): The described JWT bypass targets the FortiMonitorOnSight portal.
  • T1189 Drive-by Compromise (medium confidence): A malicious website visit is the entry point for the extension path.

14. Unknowns and Further Investigation

  • The status of FortiMonitorOnSight 7.2.3 and other branches. They are not listed in the FG-IR-26-170 table, so this report does not classify them as affected or unaffected.
  • The specific functionality accessible through the JWT bypass, the mechanism by which the extension changes traffic routing, and the scope of affected traffic. Further information on in-the-wild exploitation or public PoCs.

15. Impact on SOCs and Organizations

Asset management needs to cover managed-browser extension versions as well as the FortiPAM server. For FortiMonitorOnSight, investigate unauthorized use of existing JWTs and sessions.

16. Audience Summaries

  • SOC: For the JWT path, trace request, authentication result, and protected operation. For the extension path, trace browsing, extension activity, and proxy traffic separately.
  • Administrators: Patch the affected products and extension and restrict portal access where appropriate. Assess operational impact before temporarily disabling an extension used for privileged access.
  • Users: Update the extension as directed by administrators and report suspicious websites or connection behavior.

Top comments (0)