CVE-2026-121637 Details
Description
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.
A vulnerability has been identified in WatchGuard AuthPoint Gateway versions 1.0 through 7.5.9, specifically within the LDAP authentication callback. This vulnerability allows a network attacker with a valid header signature to manipulate the authentication result and transaction identifier in the request body, leading to unauthorized session outcomes. The issue arises from improper integrity validation, which could enable transaction or event tampering via application API manipulation.
Users can upgrade to WatchGuard AuthPoint Authentication Gateway version 7.6.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://psirt.watchguard.com/CVE-2026-121637 | WatchGuard Technologies, Inc. | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | WatchGuard Technologies, Inc. |
Affected Products
| Product | Versions |
|---|---|
| WatchGuard AuthPoint Gateway | >= 1.0, < 7.6.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | WatchGuard Technologies, Inc. |