An improper authentication flaw in WatchGuard Fireware OS’s AuthPoint multi‑factor authentication process allows a local, unauthenticated attacker to hijack another user’s in‑progress MFA session by sending a crafted request that convinces the victim to accept a push notification. The flaw effectively bypasses authentication (CWE-287) and misleads the system into assuming the request is legitimate (CWE-346). If exploited, an attacker can control or configure the device, potentially gaining broader network access and compromising confidentiality and integrity of the appliance.

The vulnerability affects all WatchGuard Fireware OS appliances that have not been upgraded to the patched releases 2026.4 or 12.12.4. Any earlier Fireware OS version that contains the AuthPoint MFA component is potentially vulnerable, and the CNA explicitly recommends applying the cited updates.

The CVSS score of 5.6 indicates moderate severity. EPSS data is not available, so the likelihood of exploitation in the wild cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. Attackers must have local network presence to craft the request, and the victim must be prompted to accept the push notification, making exploitation conditions somewhat restrictive. Nevertheless, the combination of local access and a user‑dependent action creates a real risk of session hijacking for unpatched appliances.