SSO lets one identity access multiple services, reducing password reuse while making account, session, and identity-provider security critical.
Search across headline titles and summaries.
Background for this topic.
Single sign-on (SSO) lets a user authenticate once with a central identity provider and then access multiple applications without signing in separately to each one. Applications commonly rely on federation protocols such as SAML or OIDC to accept an assertion or token from that provider. SSO centralizes authentication; it does not by itself make every connected application secure or eliminate the need for authorization.
The concentration of access makes the identity provider a high-value target: a stolen password, session, or authentication token may provide access to many services. Phishing-resistant MFA, risk-based access controls, secure token and session handling, and careful configuration of application trust reduce that exposure. Organizations should also monitor provider and federation logs, review which applications can rely on SSO, and promptly disable accounts and sessions when roles change or employment ends. Misconfigured claims or overly broad application permissions can otherwise grant more access than intended.
Fortinet has begun releasing security updates to address a critical flaw impacting FortiOS that has come under active exploitation in the wild
Fortinet has confirmed a new, actively exploited critical FortiCloud single sign-on (SSO) authentication bypass vulnerability, tracked as CVE-2026-24858, and says it has mitigated the zero-day attacks by blocking FortiCloud SSO connections from devices running vulnerable firmware versions. [...]