Header injection in captive portal authentication form

{
  "id": "d61d45541e4bb495a40b65d7517ee5b9a26120908aac61914920d67c5efc5bc3",
  "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-153",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Header injection in captive portal authentication form",
    "summary": "FortiOS and FortiProxy captive portal authentication may allow an attacker who can intercept and modify an authentication request to inject arbitrary HTTP headers. FortiOS and FortiProxy 7.6.0 through 7.6.4 are fixed by upgrading to 7.6.5 or above; the 7.4 and 7.2 branches must migrate to a fixed release.",
    "evidence": "An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted HTTP requests.",
    "products": [
      {
        "name": {
          "value": "FortiOS",
          "evidence": "FortiOS 7.6"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.6.5 or above",
            "evidence": "Upgrade to 7.6.5 or above"
          }
        ],
        "affected_versions": [
          {
            "value": "7.6.0 through 7.6.4",
            "evidence": "7.6.0 through 7.6.4"
          }
        ]
      },
      {
        "name": {
          "value": "FortiOS",
          "evidence": "FortiOS 7.4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "a fixed release",
            "evidence": "Migrate to a fixed release"
          }
        ],
        "affected_versions": [
          {
            "value": "7.4 all versions",
            "evidence": "7.4 all versions"
          }
        ]
      },
      {
        "name": {
          "value": "FortiOS",
          "evidence": "FortiOS 7.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "a fixed release",
            "evidence": "Migrate to a fixed release"
          }
        ],
        "affected_versions": [
          {
            "value": "7.2 all versions",
            "evidence": "7.2 all versions"
          }
        ]
      },
      {
        "name": {
          "value": "FortiProxy",
          "evidence": "FortiProxy 7.6"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "7.6.5 or above",
            "evidence": "Upgrade to 7.6.5 or above"
          }
        ],
        "affected_versions": [
          {
            "value": "7.6.0 through 7.6.4",
            "evidence": "7.6.0 through 7.6.4"
          }
        ]
      },
      {
        "name": {
          "value": "FortiProxy",
          "evidence": "FortiProxy 7.4"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "a fixed release",
            "evidence": "Migrate to a fixed release"
          }
        ],
        "affected_versions": [
          {
            "value": "7.4 all versions",
            "evidence": "7.4 all versions"
          }
        ]
      },
      {
        "name": {
          "value": "FortiProxy",
          "evidence": "FortiProxy 7.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "a fixed release",
            "evidence": "Migrate to a fixed release"
          }
        ],
        "affected_versions": [
          {
            "value": "7.2 all versions",
            "evidence": "7.2 all versions"
          }
        ]
      }
    ],
    "severity": "low",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-62826",
        "evidence": "CVE ID CVE-2025-62826"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity Low"
  },
  "source_id": "official-fortinet-psirt",
  "document_id": 23584,
  "published_at": "2026-07-14T07:00:00+00:00"
}