Fortinet VPN design flaw hides successful brute-force attacks

Pentera researchers found that FortiClient VPN records successful logins only after both authentication and authorization steps; by halting the process after authentication the server logs only failed attempts, allowing attackers to verify credentials without logging successes. Pentera released a script demonstrating the technique and reported the issue to Fortinet, which did not classify it as a vulnerability; the method increases the risk of stealthy credential validation and potential later unauthorized access despite additional device-compliance checks.