CVE-2026-121640
Received Received - Intake

Authentication Bypass by Capture-Replay in WatchGuard AuthPoint Gateway

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WatchGuard Technologies, Inc.

Description
An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121640
EUVD
EUVD-2026-116930

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WatchGuard AuthPoint Authentication Gateway 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway. An attacker who captures a legitimate request between AuthPoint Gateway components can replay it to perform unauthorized administrative actions, including disrupting authentication services.

Detection Guidance

To detect this vulnerability, monitor network traffic for replayed authentication requests between AuthPoint Gateway components. Inspect logs for repeated administrative actions or unusual session patterns. WatchGuard recommends checking for requests originating from unauthorized sources mimicking legitimate AuthPoint Gateway traffic.

Impact Analysis

An attacker could exploit this to gain unauthorized administrative access, disrupt authentication services, or perform actions as if they were a legitimate admin. This could lead to service outages or unauthorized changes in the system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized administrative actions through replayed requests. GDPR requires strong authentication and protection against unauthorized access, while HIPAA mandates secure authentication for protected health information. The bypass could lead to unauthorized changes or disruptions in authentication services, violating these requirements.

Mitigation Strategies

Immediately upgrade AuthPoint Authentication Gateway to version 7.6.0 or later. Disable any exposed administrative interfaces temporarily if an upgrade is not immediately feasible. Review and restrict network access to AuthPoint Gateway components to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...