FortiAuthenticator <=6.6.10 & <=8.0.3 Hardcoded Password Bypass
CVE-2026-126257 Published on November 11, 2026
A use of hard-coded password vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to bypass credential validation in certain circumstances outside of the attacker's control and gain unauthorized access.
Vulnerability Analysis
CVE-2026-126257 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
Use of Hard-coded Password
The software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Products Associated with CVE-2026-126257
Want to know whenever a new CVE is published for Fortinet Fortiauthenticator? stack.watch will email you.
Affected Versions
Fortinet FortiAuthenticator:- Version 8.0.0, <= 8.0.3 is affected.
- Version 6.6.0, <= 6.6.10 is affected.