OPSWAT. Unit 515
Network Security · Research

Testing public exploit claims for an SSO authentication bypass

Public proofs of concept for a widely reported SSO bypass did not work, so we rebuilt the conditions in the lab to find out what an attacker really needs.

theblackturtleSecurity Researcher · Feb 26, 2026 · 1 min read
On this page

What we tested

Several write-ups claimed one-request exploitation. We replayed each published proof of concept against lab devices on affected and fixed firmware.

  • FortiOS
  • FortiWeb
  • FortiProxy

Result

Unit 515 verdict

The flaw is real and repeatable once its prerequisites are met, but none of the public scripts met them. Defenders should patch on the vendor's timeline, not on the noise.

Tags
  • SAML
  • Authentication

About the author

theblackturtle

Security Researcher

Works on web application and authentication research, and maintains several of the open-source reconnaissance tools Unit 515 contributes to.

Keep Reading

More vulnerability deep dives from Unit 515.

Oct 16, 2026 | IoT & Embedded SecurityChaining a replayed login into full control of a home camerainsominaRead More →Mar 25, 2026 | Network SecurityFrom a lobby account to a switch that will not boot: four Catalyst 9300 CVEsthanhlocpandaRead More →Jul 29, 2025 | Application SecurityHow an incomplete patch left a dashboard account takeover openinsominaRead More →
View all research

Stay Updated on Unit 515 Research

Get updates on vulnerability discoveries, technical analyses, and the latest research from OPSWAT Unit 515.

Subscribe