Hardcoded Encryption Key Used for VPN Saved Passwords

Summary

A Missing Authorization [CWE-862] in FortiClient Windows may allow an authenticated local attacker to decrypt a currently logged in users VPN password via use of an unprotected DLL function.

Acknowledgement

Fortinet is pleased to thank Alex Ghiotto of HackerHood Research Group for reporting this vulnerability under responsible disclosure.

Timeline

2026-05-12: Initial publication