---
id: "CVE-2026-121637"
kind: "vulnerability"
aliases: ["CVE-2026-121637"]
title: "WatchGuard AuthPoint Gateway: forged LDAP authentication results accepted as valid sessions"
severity: "high"
cvss: 8.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "AuthPoint Authentication Gateway", "fixed": ["7.6.0"], "affected": ">= 1.0, < 7.6.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authpoint", "infrastructure", "ldap", "mfa", "self-hosted", "watchguard"]
not_affected_if: ["no-ldap-provider", "unknown"]
published_at: "2026-11-04T15:17:42+00:00"
first_seen_at: "2026-11-04T15:27:30+00:00"
updated_at: "2026-11-04T15:32:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121637", "first_seen_at": "2026-11-04T15:27:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T15:32:14+00:00"}]
---

# WatchGuard AuthPoint Gateway: forged LDAP authentication results accepted as valid sessions

WatchGuard AuthPoint Gateway does not properly check the integrity of its LDAP authentication callback. A network attacker who already holds a valid header signature can forge the authentication result and transaction ID, producing unauthorized session outcomes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AuthPoint Authentication Gateway affected >= 1.0, < 7.6.0 fixed 7.6.0

## How to check

Only Gateways configured with an LDAP provider are exposed. Check the installed AuthPoint Gateway version (any version >= 1.0 and < 7.6.0 is affected) and whether an LDAP provider/external identity is configured.

## Fix

Upgrade AuthPoint Gateway to 7.6.0 or later (WatchGuard PSIRT solution; 7.6.0 released 29 Oct 2026).

## Timeline

- 2026-11-04T15:27:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121637
- 2026-11-04T15:32:14+00:00 analyst — Read WatchGuard PSIRT page: affected >=1.0,<7.6.0, fixed 7.6.0, exposure requires LDAP provider; no known exploitation. LDAP not stated as default; how_to_check is my wording, not verified. Sibling AuthPoint CVEs 121638/121639/121640 share the same fix.

## Documents

- [advisory] WatchGuard PSIRT: CVE-2026-121637 https://psirt.watchguard.com/CVE-2026-121637
- [fix] AuthPoint Gateway releases (v7.6.0, 29 Oct 2026) https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/agent_releases.html

## From the sources

An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_