AUTHPOINT AUTHENTICATION GATEWAY · CVE-2026-121640 · Vendor
FIX → 7.6.0 ✓ verified
WatchGuard AuthPoint Gateway before 7.6.0 does not stop replayed requests between its components. An attacker who has observed a legitimate request can replay it to perform unauthorized administrative actions, including disrupting authentication services. WatchGuard is not aware of exploitation.
first public Nov 4, 2026 · 2 sources
Use AuthPoint Authentication Gateway? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organizations that run the WatchGuard AuthPoint Gateway (on-premises, used for RADIUS, LDAP sync and ADFS) at any version from 1.0 up to but not including 7.6.0. The attacker must have observed a legitimate request between Gateway components, so network position on the Gateway traffic matters. Teams that use AuthPoint without installing a Gateway can skip it.
Who cares authpoint, mfa, replay, self-hosted, watchguard
7.6.0 is affectedUpgrade to 7.6.0
Upgrade AuthPoint Gateway to 7.6.0 or later
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.
This page as .md · .json · in your agent: get_signal("CVE-2026-121640") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.