CVE-2026-95676 is a high severity (CVSS 7.5 in the record) authentication flaw in WatchGuard AuthPoint Gateway, versions 4.2.2 up to before 7.5.1. LDAP Sync first factor authentication can be bypassed under non default conditions, though other factors still apply. WatchGuard's fix is version 7.5.1.
What's affected
WatchGuard's advisory lists AuthPoint Authentication Gateway at 4.2.2 and later but earlier than 7.5.1 as affected, and 7.5.1 as not affected. The solution is to move to 7.5.1. The weaknesses are CWE-287, improper authentication, and CWE-636, not failing securely.
Where sources differ. The record says CVSS 7.5 high, from a version 3.1 vector. WatchGuard's advisory says High 7.4 using CVSS version 4.0. Both are high.
The advisory says the flaw lets a remote attacker bypass single factor password verification in the LDAP Sync first factor path, under non default operating conditions, and that additional authentication factors still apply. WatchGuard says it is not aware of any exploitation in the wild.
How to check if you're exposed
Find the AuthPoint Gateway version on each server where it is installed. The version is shown in the gateway's management console. Anything from 4.2.2 up to but not including 7.5.1 is affected.
Then check whether you use the LDAP Sync first factor path, and whether your configuration matches the non default conditions in WatchGuard's advisory. Open the advisory in full and compare it with how your gateway is set up.
What to do now
- Upgrade AuthPoint Gateway to version 7.5.1 or later.
- Read WatchGuard's advisory for the operating conditions it calls non default and check whether you use them.
- Make sure the extra authentication factors are required for every account that the gateway serves. The advisory says they still apply.
- Review authentication logs for logins that succeeded without the expected password step.
- Keep the gateway host patched and limit network access to it.
Why it matters
Multi factor sign in only works when each factor is checked. This flaw is a first factor check that fails open under certain conditions, which is the meaning of CWE-636: when something goes wrong, the system lets the user through rather than stopping them. The second factor still protects the account, so the attacker moves from needing two factors to needing one.
That is a real weakening, and a stolen or guessed second factor now carries more weight. WatchGuard is not aware of exploitation, and the CVE is not in CISA's catalog. The main task is to upgrade and check that every user is enrolled in the other factors.
Quick check
Does it bypass multi factor entirely?
No. The advisory says additional authentication factors still apply. It bypasses the first factor password check in the LDAP Sync path.
Which version fixes it?
AuthPoint Authentication Gateway 7.5.1.
Sources
Last reviewed: 18 October 2026.
