FortiClient 7.4.1 to 7.4.3 Update broke SAML via FireFox Dev Edition?

[sam_shannon_dialog]

Hi Folks,

I upgraded from FortiClient (VPNOnly) 7.4.1 to 7.4.3 per instruction from my VPN provider last week, and where before SAML via External Browser worked fine with Firefox Developer Edition, it has stopped working on the newer version.

It now shows an NS_ERROR_CONNECTION_REFUSED on reaching the 127.0.0.1:8020 part, yet when using Edge/Chrome as the browser it works as expected/previously.

I hear anecdotally that others using regular Firefox are not experiencing this issue either.

I've tried restarting the PC and reinstalling FortiClient three times (at least), as well as repeatedly retrying the connection. Zero successes. 

Any thoughts? I'm at my wits end a bit here.
I'm reticent to start bouncing around alternate versions, as I'm in a managed environment and it takes time to grab the version-specific downloads from the VPN provider and then have my own IT department manage the uninstall/reinstall process, so anything I can do without admin permissions is a good place to start.

To get back to normal though, I'm not above hounding them if it comes to it!

Cheers.

[sam_shannon_dialog]

Replying to add, I've found entries in the Event Viewer (should've looked there sooner!), corresponding with every failed attempt.

I don't see an 'attach log file' mechanism, so here goes:

Log Name:      Application
Source:        Application Error
Date:          25/08/2025 11:46:12 AM
Event ID:      1000
Task Category: Application Crashing Events
Level:         Error
Keywords:      
Description:
Faulting application name: FortiTray.exe, version: 7.4.3.1790, time stamp: 0x67db43fc
Faulting module name: ucrtbase.dll, version: 10.0.26100.4768, time stamp: 0xdbb54def
Exception code: 0xc0000409
Fault offset: 0x00000000000a4ace
Faulting process id: 0x454C
Faulting application start time: 0x1DC1561B5BF1F06
Faulting application path: C:\Program Files\Fortinet\FortiClient\FortiTray.exe
Faulting module path: C:\Windows\System32\ucrtbase.dll
Report Id: 3cc35272-204d-493f-a960-1ae004cc7f61
Faulting package full name: 
Faulting package-relative application ID: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" Guid="{a0e9b465-b939-57d7-b27d-95d8e925ff57}" />
    <EventID>1000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>100</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2025-08-25T01:46:12.8376535Z" />
    <EventRecordID>36007</EventRecordID>
    <Correlation />
    <Execution ProcessID="2304" ThreadID="5088" />
    <Channel>Application</Channel>
    <Security UserID="S-1-12-1-4002431670-1296531492-3726831525-3275369221" />
  </System>
  <EventData>
    <Data Name="AppName">FortiTray.exe</Data>
    <Data Name="AppVersion">7.4.3.1790</Data>
    <Data Name="AppTimeStamp">67db43fc</Data>
    <Data Name="ModuleName">ucrtbase.dll</Data>
    <Data Name="ModuleVersion">10.0.26100.4768</Data>
    <Data Name="ModuleTimeStamp">dbb54def</Data>
    <Data Name="ExceptionCode">c0000409</Data>
    <Data Name="FaultingOffset">00000000000a4ace</Data>
    <Data Name="ProcessId">0x454c</Data>
    <Data Name="ProcessCreationTime">0x1dc1561b5bf1f06</Data>
    <Data Name="AppPath">C:\Program Files\Fortinet\FortiClient\FortiTray.exe</Data>
    <Data Name="ModulePath">C:\Windows\System32\ucrtbase.dll</Data>
    <Data Name="IntegratorReportId">3cc35272-204d-493f-a960-1ae004cc7f61</Data>
    <Data Name="PackageFullName">
    </Data>
    <Data Name="PackageRelativeAppId">
    </Data>
  </EventData>
</Event>

[AEK]

Hi Sam

Can you redo the test when Windows' firewall is disabled?

[sam_shannon_dialog]

Not without negotiating the process with my company IT department, so I'll add that to the backlog of checks to try if nothing I can try without them gets any results.

Will let you know, cheers!

[sferoz]

Hi sam_shannon_dialog,
Is the same issue occurs on other browser chrome,IE,edge etc. Are there any other changes apart from the FCT upgrade? 
Can you help share the FGT version, TAC case no if any created for the issue for more investigation.

[sam_shannon_dialog]

Hi,
No, as mentioned, Chrome and Edge do not experience the same issue.

No other changes apart from the FortiClient upgrade.

Not sure what FGT is, nothing in my task manager shows a 'G'-starting word after FortiClient:

Unless it refers to FortiGate? Which is not something me or my company manage, so I can put in a request to find out, but who knows when that'll happen.

Not sure what a TAC case no is, but this is the sole avenue of support available to me. Anywhere else I ask about the VPNOnly FortiClient software I get rebuffed because they don't offer support for it.
Cheers.

[ebi1]

hello,

since a few days ago I have a similar problem on one windows 11 client with saml authentication: when the external browser (any browser) callback on 127.0.0.1:8020 it does not find anything listening on port 8020;

there is notthing using port 8020 and I also see the error posted by Sam for fortitray.exe and ucrtbase.dll in event viewer;

the problem is not the firewall/antivirus (it's ESET , we have rules to allow forticlient, but we did also test disabling it);

reinstalling forticlient and visual c++ runtime (ucrtbase.dll belongs to this runtime) does not fix.

Using FortiClient internal browser fix the problem, maybe because it does not need to callback on the web service on tcp/8020, but is not an option for us to use internal browser.

it looks like a client side problem, as we have hundreds of other client working correctly with the same configuration

any hints? did someone saw problem like this?

[ebi1]

hello,
for the records, I tell all of you that we did solve with some OS file cleanup:

DISM.exe /Online /Cleanup-image /Restorehealth 

sfc /scannow

PS someone did suggest to also follow this tip: https://community.fortinet.com/t5/FortiClient/Technical-Tip-FortiClient-not-appearing-in-system-tray...

[sam_shannon_dialog]

After subsequent testing, I've determined that the issue does not arise when tested on:

1. Edge
2. Chrome
3. Firefox

So it's an issue seemingly specific to Firefox Developer Edition.

I've tested with Firefox Dev Edition in Troubleshooting mode (disabled extensions, themes, and custom settings) and it still failed in the same way.

I also tried installing a User Agent switcher and having it pretend to be Chrome, but it still caused the same error.
The installed version of vcredist seems to be the correct (ie: latest) one.

Still at a complete loss as to the cause. The only change was the version of FC is newer...

[sam_shannon_dialog · Accepted solution]

Eventually found the solution to be a very strange one.

If the proxy settings for the browser are "Use System" in Firefox/Dev Edition, FortiClient will always crash when the browser tries to finalise the auth with it. Even if the "System" proxy settings are to use no proxy.

The solution is as simple as changing the browser proxy setting to "None".
Though it may also be possible to futz with the windows proxy settings in a way that also fixes it, there's not a lot you can edit when it's not configured to use one in the first place.