Hard-coded password in FortiAuthenticator may bypass checks
Original title: Authentication bypass
An unauthenticated attacker may gain access only in circumstances outside their control; Fortinet scores it 9.0.
Fortinet revised a PSIRT advisory on November 10 about a hard-coded password in FortiAuthenticator. An unauthenticated attacker may bypass credential validation and gain unauthorized access, but only in certain circumstances outside the attacker’s control. Versions, a fix, a CVE, and exploitation are not included.
Unconfirmed: The exploitable circumstances, affected versions, fix, CVE, and real-world use are not stated.
- The weakness is CWE-259, use of a hard-coded password.
- CVSSv3 score is 9.0.
- No authentication is required for the described bypass.
- The advisory was revised on November 10, 2026.
Impact: Unauthenticated bypass of credential validation
| Product | Affected |
|---|---|
| Fortinet FortiAuthenticator | — |
- Vendors
- Fortinet
- Products
- FortiAuthenticator
From the original article
CVSSv3 Score: 9. 0 A Use of Hard-coded Password [CWE-259] vulnerability in FortiAuthenticator may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.