ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
Trend Micro's Zero Day Initiative published ZDI-26-771, an authentication-bypass flaw in Fortinet FortiSandbox involving hard-coded credentials in login_user_profile. Remote attackers can bypass authentication without valid credentials. ZDI assigned a CVSS score of 7.3 and CVE-2026-107656. The advisory does not state that the issue is being exploited.
- Unauthenticated remote authentication bypass in Fortinet FortiSandbox
- Hard-coded credentials in the login_user_profile component
- ZDI rates the issue CVSS 7.3 and assigns CVE-2026-107656
- Advisory does not report observed exploitation
Vulnerabilities mentionedAll →
- published —
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-107656 | NVD description · AI analysis pending | — | — | — | — | — |
This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-107656.
This source does not provide full text. Read it at zerodayinitiative.com.