gcdRadar
live/Patch now/AIR-2026-1870
livelivePatch now2 Disclosed vulnerability

FortiAuthenticator hard‑coded password enables authentication bypass

FortiAuthenticator

A hard‑coded password (CWE‑259) in FortiAuthenticator can be used by an unauthenticated attacker to bypass credential validation. The flaw has a CVSS v3 score of 9.0 and may lead to unauthorized access.

why this severityCritical CVSS 9.0 disclosed vulnerability, no confirmed exploitation

CVSS
9.0
fix status
Fix status unknown
first report
10 Nov 2026
last update
10 Nov 2026

Timeline · 1

  1. 10 Nov 2026Authentication bypass

Sources · 1

Advisories and databases

  1. 2026-11-10
    Authentication bypass
    Fortinet · fortiguard.fortinet.com/psirt/FG-IR-26-271

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
No AI role
categories
General security
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Not applicable
owasp llm top 10
no entry for these categories
mitre atlas
no technique for these categories
tags
authentication-bypasshard-coded-passwordcvefortiguard
dates
happened 10 Nov 2026 · first reported 10 Nov 2026
origin
News & research feeds
record
confidence 0.95 · created 2026-11-10 20:42Z · updated 2026-11-10 20:42Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# FortiAuthenticator hard‑coded password enables authentication bypass

https://gcdradar.vercel.app/incidents/fortiauthenticator-hard-coded-password-enables-authenticatio · AIR-2026-1870 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical CVSS 9.0 disclosed vulnerability, no confirmed exploitation
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: No AI role
- Products: FortiAuthenticator
- CVSS: 9

## Summary

A hard‑coded password (CWE‑259) in FortiAuthenticator can be used by an unauthenticated attacker to bypass credential validation. The flaw has a CVSS v3 score of 9.0 and may lead to unauthorized access.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-10: Authentication bypass (https://fortiguard.fortinet.com/psirt/FG-IR-26-271)

## Sources

- 2026-11-10 Fortinet: Authentication bypass https://fortiguard.fortinet.com/psirt/FG-IR-26-271

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed
    FortiOS Fortinet patches critical FortiOS flaws found with AI help

    Patch now · Disclosed · Patched · since 26 Oct 2026

  2. live
    Dixell refrigeration units Multiple vulnerabilities discovered in Dixell refrigeration units

    Patch now · Exploited · since 13 Nov 2026

  3. live8.6
    UnrealIRCd CVE-2026-114713: UnrealIRCd improper neutralization of delimiters vulnerability

    Patch now · Exploited · Partly patched · since 13 Nov 2026 · CVE-2026-114713

  4. live
    City of Osaka municipal systems City of Osaka suffers data breach impacting one million residents

    Breaches & attacks · Real loss · since 13 Nov 2026

  5. live
    University of Texas at Arlington discloses data breach from cyberattack

    Breaches & attacks · Exploited · since 13 Nov 2026

  6. live
    PDF viewers Genuine PDF Forgeries: Attacking Signature Verification via Human Factors

    Research · since 13 Nov 2026