{"id":"CVE-2026-126257","kind":"vulnerability","aliases":["CVE-2026-126257"],"related":[],"title":"Fortinet FortiAuthenticator: hard-coded password lets attackers bypass login checks","description":"A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain a hard-coded password. An unauthenticated attacker may be able to bypass credential validation under certain circumstances and gain unauthorized access.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","fortiauthenticator","fortinet","identity","infrastructure"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed FortiAuthenticator version in the admin interface against the affected ranges `8.0.0` to `8.0.3` and `6.6.0` to `6.6.10`","fix":"- Move FortiAuthenticator 8.0.x to a release after `8.0.3`\n- Move FortiAuthenticator 6.6.x to a release after `6.6.10`\n- Exact fixed versions: unknown, the sources do not say","status":"open","published_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","triaged_at":"2026-11-11T22:31:14+00:00","updated_at":"2026-11-11T22:31:14+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T22:31:14Z","model":"claude-haiku-5-5","output":{"fix":"- Move FortiAuthenticator 8.0.x to a release after `8.0.3`\n- Move FortiAuthenticator 6.6.x to a release after `6.6.10`\n- Exact fixed versions: unknown, the sources do not say","reach":"unknown","title":"Fortinet FortiAuthenticator: hard-coded password lets attackers bypass login checks","impact":"high","summary":"FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain a hard-coded password. An unauthenticated attacker may be able to bypass credential validation under certain circumstances and gain unauthorized access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["fortinet","fortiauthenticator","identity","authentication"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker gains unauthorized access to the authentication server","analyst_note":"Confirm fixed versions and exposure conditions from the Fortinet PSIRT advisory; NVD text alone does not state them.","how_to_check":"- Check the installed FortiAuthenticator version in the admin interface against the affected ranges `8.0.0` to `8.0.3` and `6.6.0` to `6.6.10`\n- unknown for other checks, the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are exposed. The sources do not say which deployment settings or network exposure are needed to trigger the bypass, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00078,"input_tokens":4585,"output_tokens":642,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126257':14A,17A '-2026':13A,16A '6.6.0':28B,69C '6.6.10':30B,71C '8.0.0':24B,65C '8.0.3':26B,67C 'abl':42B 'access':53B,93C 'allow':73C 'attack':8A,39B,76C,87C 'authent':18B 'bypass':9A,44B,78C 'certain':48B,82C 'check':11A 'circumst':49B,83C 'code':5A,35B,59C 'contain':31B 'control':89C 'credenti':45B,79C 'cve':12A,15A 'fortiauthent':2A,19B,23B,64C,68C 'fortinet':1A,20B,63C 'gain':51B,91C 'hard':4A,34B,58C 'hard-cod':3A,33B,57C 'ident':21B 'infrastructur':22B 'let':7A 'login':10A 'may':40B,72C 'outsid':84C 'password':6A,36B,60C 'unauthent':38B,75C 'unauthor':52B,92C 'use':55C 'valid':46B,80C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiAuthenticator 8.0.0 through 8.0.3 or 6.6.0 through 6.6.10 are exposed. The sources do not say which deployment settings or network exposure are needed to trigger the bypass, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["authentication","critical","fortiauthenticator","fortinet","identity","infrastructure"],"campaign_type":null,"search_a":"'-126257':14A,17A '-2026':13A,16A 'attack':8A 'bypass':9A 'check':11A 'code':5A 'cve':12A,15A 'fortiauthent':2A 'fortinet':1A 'hard':4A 'hard-cod':3A 'let':7A 'login':10A 'password':6A","search_b":"'6.6.0':28B '6.6.10':30B '8.0.0':24B '8.0.3':26B 'abl':42B 'access':53B 'attack':39B 'authent':18B 'bypass':44B 'certain':48B 'circumst':49B 'code':35B 'contain':31B 'credenti':45B 'fortiauthent':19B,23B 'fortinet':20B 'gain':51B 'hard':34B 'hard-cod':33B 'ident':21B 'infrastructur':22B 'may':40B 'password':36B 'unauthent':38B 'unauthor':52B 'valid':46B","search_c":"'6.6.0':69C '6.6.10':71C '8.0.0':65C '8.0.3':67C 'access':93C 'allow':73C 'attack':76C,87C 'bypass':78C 'certain':82C 'circumst':83C 'code':59C 'control':89C 'credenti':79C 'fortiauthent':64C,68C 'fortinet':63C 'gain':91C 'hard':58C 'hard-cod':57C 'may':72C 'outsid':84C 'password':60C 'unauthent':75C 'unauthor':92C 'use':55C 'valid':80C 'vulner':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126257","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126257","severity":null,"published_at":"2026-11-11T22:17:25+00:00","modified_at":"2026-11-11T22:17:25+00:00","first_seen_at":"2026-11-11T22:29:33+00:00","fetched_at":"2026-11-11T22:29:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}