CoreCVE
Back

HIGH

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials

Published Mar 24, 2025

Description

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials.

Affected products

Remediation

Vendor solution

Please upgrade to FortiMail version 7.0.0 or above Please upgrade to FortiMail version 6.4.5 or above

Metrics

Weaknesses (1)

CWE-338

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner fortinet
Published Mar 24, 2025
Updated Mar 31, 2025
Reserved Jan 25, 2021
Link CVE-2021-26091
CISA Vulnrichment
Updated Mar 31, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2021-26091
Red Hat
Severity n/a
Public date n/a
Links CVE-2021-26091