WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640)

WatchGuard published four advisories for the AuthPoint Authentication Gateway, the on-premises component that connects its AuthPoint MFA service to local LDAP and RADIUS authentication. CVE-2026-121637 (CVSS 8.9) lets a network attacker who has a valid header signature forge the authentication result and transaction id in the LDAP authentication callback. CVE-2026-121640 (9.1) lets an attacker who observed a legitimate request between Gateway components replay it to perform administrative actions. CVE-2026-121638 (9.1) is improper certificate validation that lets an on-path attacker intercept and modify traffic between the Gateway and local authentication providers. CVE-2026-121639 (9.2) is missing authentication that lets a remote unauthenticated attacker with network access disrupt authentication and delete the local directory sync configuration. All versions from 1.0 up to 7.6.0 are affected; update the AuthPoint Gateway to 7.6.0, released October 29.

Why this severity: WatchGuard CVSS 4.0 scores 8.9 to 9.2; most bugs need a network position or an observed request, CVE-2026-121639 is unauthenticated

Started

Nov 4, 2026

CVEs

CVE-2026-121637CVE-2026-121638CVE-2026-121639CVE-2026-121640

• #WatchGuard
• #AuthPoint
• #MFA
• Auth bypass