CVE-2021-44166 Auth bypass in Fortinet FortiTokenAndroid

Medium 4.1 Published 2 Mar 2022 Updated 22 Oct 2024

Attackers with stolen passwords can bypass two-factor authentication in FortiToken Mobile Android by ignoring denial prompts during push notifications.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-44166?

CVE-2021-44166 is a medium-severity authentication bypass vulnerability in Fortinet FortiTokenAndroid, published on 2 Mar 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.

Which versions are affected by CVE-2021-44166?

It affects 1 product.

Products include Fortinet Fortitoken Mobile.

How do I fix CVE-2021-44166?

No fix has been published for CVE-2021-44166 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-44166 being exploited?

There is no known exploitation of CVE-2021-44166 in the wild and no public exploit code.

Sources

Also known as GHSA-7w6m-4c3c-jjv3.