Use of hardcoded key for the JWT token Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-22-071 Final 1 1 2022-06-07T00:00:00 Current version 2022-06-07T00:00:00 2022-06-07T00:00:00 A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device. None Improper access control FortiDDoS 5.6 all versions are not affectedFortiDDoS 5.5 all versionsFortiDDoS version 5.4.0 through 5.4.2FortiDDoS version 5.3.0 through 5.3.1FortiDDoS 5.2 all versionsFortiDDoS 5.1 all versionsFortiDDoS 5.0 all versions are not affectedFortiDDoS 4.7 all versions are not affectedFortiDDoS 4.6 all versions are not affectedFortiDDoS 4.5 all versions are not affected Please upgrade to upcoming FortoDDoS 5.6.0 or above. Fortinet is pleased to thank Victor Pasman for bringing this issue to our attention under responsible disclosure. FortiDDoS 5.5.2 FortiDDoS 5.5.1 FortiDDoS 5.5.0 FortiDDoS 5.4.2 FortiDDoS 5.4.1 FortiDDoS 5.4.0 FortiDDoS 5.3.1 FortiDDoS 5.3.0 FortiDDoS 5.2.0 FortiDDoS 5.1.0 CVE-2022-29060 FortiDDoS-5.5.2 FortiDDoS-5.5.1 FortiDDoS-5.5.0 FortiDDoS-5.4.2 FortiDDoS-5.4.1 FortiDDoS-5.4.0 FortiDDoS-5.3.1 FortiDDoS-5.3.0 FortiDDoS-5.2.0 FortiDDoS-5.1.0 7.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R https://fortiguard.fortinet.com/psirt/FG-IR-22-071 Use of hardcoded key for the JWT token Reference>