Fortinet FortiTokenAndroid Improper Export of Application Components Vulnerability Allowing OTP Disclosure

A vulnerability exists in Fortinet FortiTokenAndroid versions 6.2, 6.1, and 5.2, due to improper export of Android application components. This flaw may enable other applications on the device to access one-time password (OTP) codes through an exported Content Provider URI.

Impact

Exploitation of this vulnerability could lead to unauthorized access to OTP codes, allowing attackers to bypass two-factor authentication mechanisms that rely on these codes.

Remediation

Users are advised to migrate to a fixed release of Fortinet FortiTokenAndroid. Instructions for downloading the latest version can be found on the Fortinet website.