The vulnerability is an authentication bypass that exploits a capture‑and‑replay flaw in WatchGuard AuthPoint Authentication Gateway. An attacker who can observe a legitimate communication exchange between AuthPoint components may replay the captured request to trigger administrative actions, such as disabling or disrupting authentication services. This allows the attacker to perform unauthorized administrative functions that compromise the confidentiality, integrity, and availability of the authentication infrastructure.

Affected products are WatchGuard AuthPoint Authentication Gateway units. The reported fix is available in version 7.6.0; therefore, all prior releases are vulnerable and should be considered impacted.

The vulnerability carries a CVSS score of 9.1, indicating very high severity. Although the EPSS score is not provided, the lack of detection incentives and the potential for catastrophic service disruption suggest a significant exploitation risk. No CISA KEV listing means no known active exploits, but the required capture of a legitimate request implies that an attacker must have network visibility between gateway components, perhaps from insider or compromised device activity. Nevertheless, the ability to perform administrative actions with existing privileges makes the risk substantial for any environment using older AuthPoint Gateway releases.