Fortinet FortiAuthenticator Vulnerable to Sensitive Information Disclosure

Fortinet's Product Security Incident Response Team (PSIRT) has issued an advisory detailing a significant security flaw in its FortiAuthenticator product. The vulnerability, identified as an "insufficiently protected credentials" issue (CWE-522), carries a CVSSv3 score of 7.5, classifying it as high severity.

An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTPS requests to the affected FortiAuthenticator instances. Successful exploitation allows the attacker to obtain sensitive information, which could include user credentials, system configurations, or other confidential data stored or processed by the device. The advisory notes that the vulnerability is present in multiple versions of FortiAuthenticator, spanning both the 8.0 and 6.6 release lines.

Specifically, the affected versions include FortiAuthenticator 8.0.3, 8.0.2, 8.0.1, 8.0.0, and all versions from 6.6.0 through 6.6.10. This broad range of affected versions indicates a widespread potential impact across organizations utilizing these products for identity and access management.

The vulnerability was discovered internally by Gwendal Guegniaud of the Fortinet Product Security team, who utilized an AI model named Claude Mythos in the discovery process. This highlights the increasing role of AI in both discovering and potentially exploiting security weaknesses.

While the advisory does not explicitly state whether this vulnerability is being actively exploited in the wild, its high CVSS score and the nature of the information disclosure make it a prime target for attackers. Organizations relying on FortiAuthenticator for critical functions such as single sign-on (SSO), multi-factor authentication (MFA), and VPN authentication should prioritize addressing this vulnerability.

Fortinet has provided a reference to the advisory (FG-IR-26-262) for detailed information. While the advisory itself does not list specific remediation steps beyond recommending users consult the advisory, it is standard practice for vendors to release security patches for such critical flaws. Users are strongly advised to check for and apply any available updates or patches from Fortinet as soon as possible to mitigate the risk of exploitation.

This incident underscores the ongoing need for diligent security practices, including regular vulnerability scanning, prompt patching, and secure configuration management, especially for devices handling sensitive authentication data. The involvement of AI in the discovery process also signals a new frontier in vulnerability research and development.