Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.9
CVE-2026-121637: WatchGuard AuthPoint Gateway can be tricked into false logins
CVE-2026-121637 · published today
Summary
The WatchGuard AuthPoint authentication gateway may accept forged login results if an attacker captures a valid signature and alters the request. This could let unauthorized users create or continue a session, bypassing normal checks. Apply the vendor's security update or patch and ensure signatures are protected and validated correctly.
What to do
- Update watchguard authpoint authentication gateway to version 7.6.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| watchguard | authpoint authentication gateway | < 7.6.0 |
Original advisory text
WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Track software like this
Free during beta