Header injection in captive portal authentication form

unknownCVE-2025-62826

CVSSv3 Score: 3.1 An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] in FortiOS and FortiProxy captive portal may allow an attacker able to intercept and modify a user's authentication request to inject arbitrary headers via crafted HTTP requests. Revised on 2026-07-14 00:00:00

CSIRTS triage

vendor: Fortinet product: FortiOS, FortiProxyOther

What: An attacker may inject arbitrary headers via crafted HTTP requests.
Who is affected: Users of FortiOS and FortiProxy captive portal.
Urgency: Remediation is important to mitigate risks of header injection.
Action: Implement input validation on authentication requests.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiOS, FortiProxy

Get an email when a new FortiOS, FortiProxy advisory drops — max one per day, one-click unsubscribe.

Details

Source: Fortinet FortiGuard PSIRT (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-153

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-628260.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-62826	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Header injection in

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-67326: GitPython before 3.1.50 fails to validate newline characters in the section parameter of confi…nvd · 2026-08-01
mediumGHSA-px9f-whj3-246m: Req vulnerable to multipart form-data header injection via unescaped name/filename/conten…ghsa · 2026-07-29
mediumCVE-2026-57511: SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthent…nvd · 2026-07-28
criticalGHSA-3735-5339-xfwx: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout R…ghsa · 2026-07-28
lowCVE-2026-66753: tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers…nvd · 2026-07-28
mediumCVE-2026-66746: Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remo…nvd · 2026-07-28