CVE-2021-26091

Description

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials.

Reserved 2021-01-25 | Published 2025-03-24 | Updated 2025-03-31 | Assigner fortinet

Problem types

Improper Access Control

Product status

Default status
unaffected

6.4.0
affected

6.2.0
affected

6.2.0 before 6.2.*
affected

References

fortiguard.com/advisory/FG-IR-21-031

cve.org (CVE-2021-26091)

nvd.nist.gov (CVE-2021-26091)

Download JSON