Unauthenticated administrative access via trusted proxy headers

Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows remote attackers to perform administrative operations. The HTTPSD access check trusts attacker-controlled Forwarded and User-Agent headers, treating a spoofed loopback client using Report Runner as a trusted internal request. Network access to the HTTP or HTTPS management interface is sufficient to modify configuration, add administrator accounts, or retrieve configuration data without credentials.