WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results

Summary

An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who has obtained a valid header signature to forge the authentication result and transaction identifier in the request body, resulting in unauthorized session outcomes.

Remediation

1. Inventory every WatchGuard AuthPoint Authentication Gateway deployment, including staging.
2. Upgrade WatchGuard AuthPoint Authentication Gateway to 7.6.0.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://psirt.watchguard.com/CVE-2026-121637