Description
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.
INFO
Published Date :
2025-10-14T15:23:08.121Z
Last Modified :
2026-01-14T09:17:03.052Z
Source :
fortinet
AFFECTED PRODUCTS
The following products are affected by CVE-2025-25252 vulnerability.
| Vendors | Products |
|---|---|
| Fortinet |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-25252.
| URL | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-24-487 |
|
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact