CVE-2021-44166: Fortinet Fortitoken Mobile

Medium severity, CVSS 4.1. EPSS: 0.7% chance of exploitation in the next 30 days.

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user.

Affected products

• Fortinet Fortitoken Mobile: version 4.0.0 only; version 4.0.1 only; version 4.1.1 only; version 4.2.1 only; version 4.2.2 only; version 4.3.0 only; …

Published 2022-03-02. Last modified 2026-06-17.