---
id: "CVE-2026-126257"
page: "https://infrastack.ai/live/CVE-2026-126257"
kind: "vulnerability"
aliases: ["CVE-2026-126257"]
title: "Fortinet FortiAuthenticator: hard-coded password lets attackers bypass login checks"
severity: "critical"
cvss: 9.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["authentication", "fortiauthenticator", "fortinet", "identity", "infrastructure"]
not_affected_if: ["other-versions"]
published_at: "2026-11-11T22:17:25+00:00"
first_seen_at: "2026-11-11T22:29:33+00:00"
updated_at: "2026-11-11T22:31:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126257", "first_seen_at": "2026-11-11T22:29:33+00:00"}]
exploit_sources: []
---

# Fortinet FortiAuthenticator: hard-coded password lets attackers bypass login checks

Link for people: https://infrastack.ai/live/CVE-2026-126257 (this .md is for agents)

FortiAuthenticator 8.0.0 through 8.0.3 and 6.6.0 through 6.6.10 contain a hard-coded password. An unauthenticated attacker may be able to bypass credential validation under certain circumstances and gain unauthorized access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed FortiAuthenticator version in the admin interface against the affected ranges `8.0.0` to `8.0.3` and `6.6.0` to `6.6.10`

## Fix

- Move FortiAuthenticator 8.0.x to a release after `8.0.3`
- Move FortiAuthenticator 6.6.x to a release after `6.6.10`
- Exact fixed versions: unknown, the sources do not say

## Timeline

- 2026-11-11T22:29:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126257

## From the sources

A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_