Fortinet FortiOS SSL-VPN: A logic flaw lets a user who changes their login case (e.g

Impact

A logic flaw lets a user who changes their login case (e.g. 'User' vs 'user') complete SSL-VPN authentication without ever being prompted for their second factor — a clean bypass of FortiToken MFA on the VPN gateway. Confirmed in CISA's KEV catalog as actively exploited; if this FortiGate is the VPN entry point into a cluster's management network, MFA was supposed to be the thing stopping a stolen password from being enough.

Who can reach it

Requires a valid username/password (e.g. phished or reused) but no second factor — the attacker just varies the case of the username at login to skip the FortiToken prompt.

What to do

Firmware upgrade to the fixed FortiOS release per Fortinet PSIRT FG-IR-19-283. Given confirmed active exploitation, patch ahead of routine cycles, and afterward force a credential rotation for any accounts that authenticated to SSL-VPN during the vulnerable window in case MFA was bypassed on them already.

References