CVE-2026-121637: WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results
Published Nov 4, 2026
·Updated
An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.
Event History
Nov 4, 2026
CVE Published
via MITRE·02:44 PM
Data Sourced
via MITRE·02:44 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need before they can exploit this issue?
The attacker needs network access and a valid header signature. The vulnerability does not require prior authentication or user interaction.
2
What can an attacker change in a forged request?
An attacker can forge the authentication result and transaction identifier in the LDAP authentication callback request body. This can lead to unauthorized session outcomes.