Critical 9.1

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows...

CVE-2026-121640 First seen on SecPulse Nov 4, 23:44

Affected packages

Ecosystem	Package	Affected	Fixed
WatchGuard	AuthPoint Authentication Gateway	≥ 1.0, < 7.6.0	7.6.0

Original description The description as published by the source.

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v4: Critical 9.1; CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Published: Nov 5, 2026
First seen on SecPulse: Nov 4, 23:44
GHSA: GHSA-xp5x-55h7-9454
CWE: CWE-294

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Authentication Bypass

CWE

CWE-294

Vendors

Watchguard

All

Authpoint Authentication Gateway

Detection sources

NIST National Vulnerability DatabaseNov 5, 04:17
GitHub Security Advisories (Global)Nov 5, 00:32
CVE.org (CVE Program・cvelistV5)Nov 5, 03:20