ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
Trend Micro's Zero Day Initiative published ZDI-26-771, an authentication-bypass flaw in Fortinet FortiSandbox involving hard-coded credentials in login_user_profile. Remote attackers can bypass authentication without valid credentials. ZDI assigned a CVSS score of 7.3 and CVE-2026-107656. The advisory does not state that the issue is being exploited.
58