PSIRTMandatory password and OTP" setting not enforcing OTP on unimported remote users
Summary
An incorrect implementation of authentication algorithm vulnerability [CWE-303] in FortiAuthenticator may allow an user whose LDAP account is unimported to bypass the second factor of authentication via a RADIUS login portal.
| Version | Affected | Solution |
|---|---|---|
| FortiAuthenticator 6.4 | 6.4.0 | Upgrade to 6.4.1 or above |
| FortiAuthenticator 6.3 | Not affected | Not Applicable |
| FortiAuthenticator 6.2 | Not affected | Not Applicable |
| FortiAuthenticator 6.1 | Not affected | Not Applicable |
| FortiAuthenticator 6.0 | Not affected | Not Applicable |
| FortiAuthenticator 5.5 | Not affected | Not Applicable |
| FortiAuthenticator 5.4 | Not affected | Not Applicable |
| FortiAuthenticator 5.3 | Not affected | Not Applicable |
| FortiAuthenticator 5.2 | Not affected | Not Applicable |
| FortiAuthenticator 5.1 | Not affected | Not Applicable |
| FortiAuthenticator 5.0 | Not affected | Not Applicable |