Unauthenticated brute-force attacks via unrestricted login attempts

Improper authentication-attempt restriction in Fortinet FortiMail webmail allows remote attackers to brute-force affected login endpoints. Affected endpoints accept repeated authentication attempts without enforcing an effective attempt limit, enabling systematic password guessing. No authentication is required, but exploitation depends on network reachability and successful credential guessing; Fortinet has not named the specific endpoints.