FortiEDR - Session API token does not expires after a renewal

An insufficient session expiration vulnerability [CWE-613] in FortiEDR may allow an attacker to reuse the unexpired user API access token to gain privileges, should the attacker be able to obtain that API access token (via other, hypothetical attacks).

access access token api attacker attacks cwe expiration fortiedr may privileges reuse session token vulnerability