WatchGuard AuthPoint Authentication Gateway Capture-Replay Bypass Enables Unauthorized Administrative Actions

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between AuthPoint Gateway components to replay it and perform unauthorized administrative actions, including disrupting authentication services.

• WatchGuard AuthPoint Authentication Gateway: affected from version 1.0 up to, but not including, 7.6.0.
• Not affected according to WatchGuard: 7.6.0 and versions covered from that release onward.
• No other product or parallel release branch is identified in the available evidence.

WatchGuard AuthPoint Authentication Gateway contains an Authentication Bypass by Capture-replay vulnerability classified as CWE-294. An attacker can observe a legitimate request exchanged between AuthPoint Gateway components and replay that request to perform unauthorized administrative actions. The record describes a network-reachable attack that requires no prior privileges or user interaction, but does require an observed legitimate request as a precondition. The implementation detail that causes replayed requests to be accepted, such as request-freshness validation or binding to a session, is not disclosed.

The vulnerability is reachable over the network. The attack attributes in the record indicate that the attacker does not need prior privileges or user interaction, but must first observe a legitimate request between gateway components before replaying it. The record characterizes the attack complexity as low, although observing the request remains a required condition. WatchGuard states that it is not aware of exploitation of this vulnerability in the wild. That statement does not establish that exploitation is impossible, and the available evidence does not identify public exploit code, a payload, or specific exploitation indicators.

If a legitimate request is replayed and accepted, an attacker may perform unauthorized administrative actions within the function represented by that request. The described impact is concentrated on integrity and availability, including the ability to disrupt authentication services. The requirement to observe a legitimate request limits the attack path, but the record indicates that no prior privileges or user interaction are required. No evidence confirms an impact to data confidentiality, arbitrary code execution, or persistent access.

Successful exploitation can enable unauthorized administrative actions on WatchGuard AuthPoint Authentication Gateway. The confirmed consequences include loss of integrity over administrative operations and possible disruption of authentication services, which may affect access to dependent services. The available evidence does not establish data disclosure, code execution, operating-system compromise, or a broader intrusion scenario.

1. Upgrade WatchGuard AuthPoint Authentication Gateway to 7.6.0. WatchGuard identifies this release as the solution and marks it as not affected.
2. Re-inventory all gateways after the upgrade to verify that no instance remains within the affected range, and confirm that authentication services continue to operate normally.
3. If an upgrade cannot be completed immediately, continue reviewing affected deployments for unusual administrative actions and authentication-service disruption. The available evidence does not provide a vendor-specific temporary mitigation.

1. Inventory systems running WatchGuard AuthPoint Authentication Gateway and determine whether each deployed release falls within the affected range.
2. Review available audit and operational records for unexpected administrative actions, unplanned changes, or unexplained authentication-service disruption.
3. Correlate those events with unusual requests between gateway components if the deployment records that type of communication.
4. Do not treat the absence of suspicious events as proof that a system is safe. WatchGuard does not disclose a specific IOC, log event, endpoint, or request pattern for this vulnerability.