WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640) ยท updates https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637 WatchGuard published four advisories for the AuthPoint Authentication Gateway, the on-premises component that connects its AuthPoint MFA service to local LDAP and RADIUS authentication. CVE-2026-121637 (CVSS 8.9) lets a network attacker who has a valid header signature forge the authentication result and transaction id in the LDAP authentication callback. CVE-2026-121640 (9.1) lets an attacker who observed a legitimate request between Gateway components replay it to perform administrative actions. CVE-2026-121638 (9.1) is improper certificate validation that lets an on-path attacker intercept and modify traffic between the Gateway and local authentication providers. CVE-2026-121639 (9.2) is missing authentication that lets a remote unauthenticated attacker with network access disrupt authentication and delete the local directory sync configuration. All versions from 1.0 up to 7.6.0 are affected; update the AuthPoint Gateway to 7.6.0, released October 29. en Wed, 04 Nov 2026 00:00:00 GMT WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640): WatchGuard publishes advisories CVE-2026-121637, CVE-2026-121638, CVE-2026-121639 and CVE-2026-121640 for AuthPoint Gateway before 7.6.0. https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637 https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637#2026-11-04-10ad3ade Wed, 04 Nov 2026 00:00:00 GMT high <p><a href="https://psirt.watchguard.com/">Source</a></p> WatchGuard AuthPoint Gateway: forged auth results, replayed admin actions, MITM and unauthenticated DoS (CVE-2026-121637 to CVE-2026-121640): WatchGuard releases AuthPoint Gateway 7.6.0, noting a resolved security vulnerability. https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637 https://pwn.watch/i/watchguard-authpoint-gateway-auth-bypass-cve-2026-121637#2026-10-29-16ba8038 Thu, 29 Oct 2026 00:00:00 GMT high <p><a href="https://www.watchguard.com/support/release-notes/cloud/Content/en-US/AuthPoint/EN_release-notes_authpoint.html">Source</a></p>