An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:NFortinet Fortitoken Mobile
APPFortinet4.0.04.0.14.1.14.2.14.2.24.3.04.4.04.5.05.0.25.0.35.1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2026-44279MEDIUM5.5ten sam produkt
An improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versi...
CVE-2021-22131MEDIUM6.4ten sam produkt
A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below,...
CVE-2026-35616CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Fortinet FortiClientEMS — nieuwierzytelnione wykonanie kodu (Auth Bypass)
CVE-2026-21643CRITICAL9.8⚠ KEVPL ✓ten sam vendor
SQL Injection w Fortinet FortiClientEMS — nieautoryzowane wykonanie kodu
CVE-2026-24858CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Fortinet – Auth Bypass przez FortiCloud SSO w wielu produktach