{"id":"CVE-2026-121640","kind":"vulnerability","aliases":["CVE-2026-121640"],"related":[],"title":"WatchGuard AuthPoint Gateway: replayed requests let attackers take admin actions","description":"An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.","summary":"WatchGuard AuthPoint Gateway before 7.6.0 does not stop replayed requests between its components. An attacker who has observed a legitimate request can replay it to perform unauthorized administrative actions, including disrupting authentication services. WatchGuard is not aware of exploitation.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AuthPoint Authentication Gateway","fixed":["7.6.0"],"affected":">= 1.0, < 7.6.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["authpoint","mfa","replay","self-hosted","vendor","watchguard"],"not_affected_if":[],"how_to_check":"Check the installed AuthPoint Gateway version on each Gateway host (primary and secondary); any version below 7.6.0 is affected. The vendor advisory does not give a check command.","fix":"Upgrade AuthPoint Gateway to 7.6.0 or later","status":"open","published_at":"2026-11-04T15:17:42+00:00","first_seen_at":"2026-11-04T15:27:31+00:00","triaged_at":"2026-11-04T15:28:22+00:00","updated_at":"2026-11-04T15:30:31+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-04T15:28:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"WatchGuard AuthPoint Gateway: replayed requests let attackers take admin actions","impact":"high","summary":"WatchGuard AuthPoint Gateway accepts a captured request between its components and accepts it again when replayed. An attacker who has observed such a request can perform unauthorized administrative actions, including disrupting authentication services.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["watchguard","authpoint","mfa","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker performs admin actions and disrupts authentication services","analyst_note":"Find the affected version ranges, fix version and whether an attacker must be on-path to observe traffic; check the NVD entry and WatchGuard's security advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running WatchGuard AuthPoint Gateway components. The sources do not state which versions are affected, what network position an attacker needs to observe traffic, or which configurations are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000636,"input_tokens":4129,"output_tokens":447,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the affected version ranges, fix version and whether an attacker must be on-path to observe traffic; check the NVD entry and WatchGuard's security advisory.","search":"'-121640':13A,16A '-2026':12A,15A '7.6.0':32B 'action':10A,56B,99C 'admin':9A 'administr':55B,98C 'allow':79C 'attack':7A,42B,81C 'authent':59B,68C,102C 'authentication':18A 'authpoint':2A,17A,20B,29B,77C,89C 'awar':64B 'bypass':69C 'captur':72C 'capture-replay':71C 'compon':40B,91C 'cve':11A,14A 'disrupt':58B,101C 'exploit':66B 'gateway':3A,19A,30B,78C,90C 'host':25B 'includ':57B,100C 'legitim':47B,86C 'let':6A 'mfa':21B 'observ':45B,84C 'perform':53B,96C 'replay':4A,22B,36B,50B,73C,93C 'request':5A,37B,48B,87C 'self':24B 'self-host':23B 'servic':60B,103C 'stop':35B 'take':8A 'unauthor':54B,97C 'vendor':26B 'vulner':74C 'watchguard':1A,27B,28B,61B,76C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run the WatchGuard AuthPoint Gateway (on-premises, used for RADIUS, LDAP sync and ADFS) at any version from 1.0 up to but not including 7.6.0. The attacker must have observed a legitimate request between Gateway components, so network position on the Gateway traffic matters. Teams that use AuthPoint without installing a Gateway can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T15:30:31Z","by":"analyst","doc":"https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/EN_release-notes_authpoint.html","run_id":1675},"products":{"at":"2026-11-04T15:30:31Z","by":"analyst","doc":"https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/EN_release-notes_authpoint.html","run_id":1675},"who_affected":{"at":"2026-11-04T15:30:31Z","by":"analyst","doc":"https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/EN_release-notes_authpoint.html","run_id":1675}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["authenticationgateway","authpointauthenticationgateway"],"ptokens":["authentication","authpoint","gateway"],"labels":["authpoint","critical","mfa","replay","selfhosted","vendor","watchguard"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5d1c2695-1a31-4499-88ae-e847036fd7e3","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121640","severity":null,"published_at":"2026-11-04T15:17:42+00:00","modified_at":"2026-11-04T15:17:42+00:00","first_seen_at":"2026-11-04T15:27:31+00:00","fetched_at":"2026-11-04T15:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121640:1675","url":null,"severity":null,"published_at":"2026-11-04T15:30:31+00:00","modified_at":"2026-11-04T15:30:31+00:00","first_seen_at":"2026-11-04T15:30:31+00:00","fetched_at":"2026-11-04T15:30:31+00:00","note":"Read WatchGuard PSIRT advisory: affected AuthPoint Gateway >=1.0,<7.6.0, fixed 7.6.0 (released 2026-10-29 per release notes). No in-the-wild exploitation known per vendor. Advisory only says attacker must have observed a legitimate request between Gateway components; does not say whether on-path is required or how to check version/mitigations (not verified). Sibling CVEs 121637/8/9 same fix."}],"documents":[{"id":67997,"url":"https://psirt.watchguard.com/CVE-2026-121640","title":"WatchGuard PSIRT CVE-2026-121640","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":67995,"url":"https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/EN_release-notes_authpoint.html","title":"AuthPoint release notes (Gateway 7.6.0)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}