Fortinet has published security advisory FG-IR-26-170 describing a critical vulnerability in the FortiMonitorOnSight web portal. The issue has been scored CVSSv3 9.6 and is related to the use of a static key to sign JWT tokens that are used for authentication in the web interface. A remote unauthenticated attacker can forge or reuse a JWT token and gain access to the system without credentials. All organizations using FortiMonitorOnSight should immediately refer to the Fortinet PSIRT portal for up‑to‑date information on patches and affected versions.
Technical details of the vulnerability
The vulnerability is classified as CWE-540 — Inclusion of Sensitive Information in Source Code. The crux of the problem is that the key used to sign JWT tokens for authentication in the FortiMonitorOnSight management web interface is static — it is not generated uniquely during installation and is not rotated during operation.
This creates two attack vectors:
- Token forgery (forged JWT) — if an attacker extracts the static key (for example, from source code, firmware, or via decompilation), they can generate a valid JWT on their own with arbitrary access rights.
- Token reuse (reused JWT) — an intercepted token remains valid because the signature is verified with the same unchanging key.
A static JWT signing key is a fundamental architectural flaw. In a proper implementation, the key should be generated in a cryptographically random manner when the system is deployed and periodically rotated. Using a key hardcoded into the code effectively turns the authentication mechanism into a formality: anyone who gains access to the key can impersonate a legitimate user with any level of privileges.
The advisory does not contain a CVE identifier, a list of affected versions, or information about patch availability. At the time of publication, it is also unknown whether the vulnerability is being exploited in real‑world attacks.
Impact assessment
The CVSSv3 score of 9.6 assigned by Fortinet indicates a critical level of severity. Such a score is typical for vulnerabilities that allow complete authentication bypass without user interaction and with a network attack vector.
FortiMonitorOnSight is a component of the Fortinet monitoring ecosystem. Compromise of the management web portal can give an attacker access to infrastructure monitoring data, configurations and, depending on the deployment architecture, the ability to influence managed devices. Organizations where FortiMonitorOnSight is exposed to the internet are at the highest risk.
We have previously covered critical vulnerabilities in Fortinet products — this issue continues the trend of discovering serious authentication flaws across the vendor’s product line.
Recommendations
Since the Fortinet advisory currently does not include information about affected versions and available updates, the following measures are recommended:
- Check whether FortiMonitorOnSight is used in your infrastructure and restrict access to its web portal — remove direct internet exposure, allowing connections only from trusted networks or via VPN.
- Monitor updates on the FG-IR-26-170 advisory page for information about the patch and affected versions.
- Analyze access logs for the FortiMonitorOnSight web interface for anomalous sessions — connections from unusual IP addresses or with atypical activity patterns.
- Apply the patch as soon as it is released by Fortinet, given the critical severity of the vulnerability and the lack of any authentication requirement for its exploitation.
Until an official fix is released, the only effective protection measure is network isolation of the FortiMonitorOnSight web portal. With a CVSSv3 score of 9.6 and the possibility of remote unauthenticated exploitation, any instance accessible from untrusted networks should be considered under immediate threat. The response priority should be maximal.
