The vulnerability resides in the LDAP authentication callback of WatchGuard AuthPoint Authentication Gateway, where an improper HMAC validation allows a malicious actor with a valid header signature to forge the authentication result and transaction identifier in the request body. This results in the creation of unauthorized sessions, giving an attacker the ability to impersonate legitimate users and potentially gain full system access.

WatchGuard AuthPoint Authentication Gateway, all releases prior to version 7.6.0, are affected. The vendor’s recommended fix is the 7.6.0 release, which addresses the improper integrity validation flaw.

The CVSS score of 8.9 indicates a high severity vulnerability. Although the EPSS score is not available, the flaw is exploitable by an attacker who can acquire a valid header signature, allowing crafted requests to be sent to the LDAP callback. The vulnerability is not listed in CISA’s KEV catalog, but the potential for unauthorized session establishment makes it a significant risk for systems exposed to untrusted network traffic. The attack vector is inferred to be a network attacker capable of sending forged requests with a valid signature to the authentication callback endpoint, thereby bypassing authentication controls.