CVE-2026-121637#
WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results
Summary #
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.
Product status #
| Product | Affected | Not affected |
|---|---|---|
| AuthPoint Authentication Gateway | >= 1.0, < 7.6.0 | >= 7.6.0 |
Required Configuration for Exposure #
This vulnerability affects AtuhPoint Gateway deployments configured with an LDAP provider.
Weakness Type and Impact #
Exploitation Status #
WatchGuard is not aware of any exploitation of this vulnerability in the wild.
Solution #
AuthPoint Authentication Gateway 7.6.0
References #
Credits #
- WatchGuard AI Security Researchfinder