Cryptographically Weak Pseudo-Random Number Generator in FortiMail Authentication

CVE-2021-26091

Summary

A vulnerability exists in FortiMail due to the use of a cryptographically weak pseudo-random number generator within its authentication system. This flaw may enable an unauthenticated attacker to deduce segments of user authentication tokens, ultimately allowing them to reset user credentials and potentially compromise user accounts. Awareness and mitigation strategies should be applied to safeguard against unauthorized access. For more information, refer to the advisory from FortiGuard.

References