Administrator impersonation via unchecked cookie index

Authentication bypass in Fortinet FortiWeb allows remote attackers to gain administrator privileges through a crafted session cookie. The httpd cookie parser uses the unvalidated Era value as a shared-memory key index, allowing an out-of-bounds read to select a predictable zero key for payload encryption and HMAC signing. Exploitation requires non-public device and user details, an active target-user session, and brute-forcing a small session value; success permits impersonation of that administrator.