AUTHPOINT AUTHENTICATION GATEWAY · CVE-2026-121637 · Infrastructure
FIX → 7.6.0 ✓ verified
WatchGuard AuthPoint Gateway does not properly check the integrity of its LDAP authentication callback. A network attacker who already holds a valid header signature can forge the authentication result and transaction ID, producing unauthorized session outcomes.
first public Nov 4, 2026 · 2 sources
Running AuthPoint Authentication Gateway? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
AuthPoint Gateway deployments configured with an LDAP provider, on any version from 1.0 up to but not including 7.6.0. An attacker needs network access and an already-obtained valid header signature, then can forge the authentication result and transaction ID in the callback. Gateways with no LDAP provider configured are outside the vendor's stated exposure; WatchGuard knows of no exploitation.
Not affected if no-ldap-provider, unknown
Who cares authpoint, ldap, mfa, self-hosted, watchguard
7.6.0 is affected) and whether an LDAP provider/external identity is configuredUpgrade to 7.6.0
Upgrade AuthPoint Gateway to 7.6.0 or later (WatchGuard PSIRT solution; 7.6.0 released 29 Oct 2026).
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.
This page as .md · .json · in your agent: get_signal("CVE-2026-121637") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.