EUVD-2026-39453
GHSA-957m-3336-c6fv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with scope change because intercepted credentials affect subsequent HYPR-protected systems; PR:L and UI:R map directly from the 4.0 PR:L/UI:P constraints.
Primary rating from Vendor (HYPR).
CVSS VectorVendor: HYPR
Lifecycle Timeline
3DescriptionCVE.org
Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Interception.
This issue affects HYPR Passwordless: before 11.1.1.
AnalysisAI
Credential interception in HYPR Passwordless on Windows (all versions before 11.1.1) is possible due to a missing authentication check on a critical internal function (CWE-306), allowing a low-privileged local attacker to capture authentication material during an active user session. The CVSS 4.0 vector's SC:H metric confirms the intercepted credentials are usable against downstream systems that HYPR protects, elevating the downstream blast radius beyond the compromised endpoint. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
HYPR Passwordless (CPE: cpe:2.3:a:hypr:passwordless:*:*:*:*:*:*:*:*) is an enterprise-grade Windows authentication platform that replaces traditional passwords with device-bound cryptographic authentication flows. CWE-306 (Missing Authentication for Critical Function) indicates that one or more internal components - likely inter-process communication channels such as named pipes, local API endpoints, or Windows message queues - involved in the authentication handshake do not enforce access controls on callers. This allows a co-resident low-privilege process to observe or directly invoke these functions without authorization. The CVSS 4.0 subsequent-system confidentiality metric (SC:H) is consistent with theft of authentication tokens or derived credentials that are valid against external identity-protected resources, enabling post-interception lateral movement.
RemediationAI
Upgrade HYPR Passwordless to version 11.1.1 or later, which is the vendor-confirmed fixed release per the advisory at https://www.hypr.com/trust-center/security-advisories. Until patching is complete, restrict interactive and remote desktop logon rights on HYPR-enrolled Windows endpoints to the smallest possible set of authorized users, reducing the pool of low-privilege accounts capable of local exploitation. Additionally, deploy endpoint detection rules to alert on unexpected processes interacting with HYPR authentication components or local IPC channels at authentication time. These controls do not eliminate the underlying unauthenticated function exposure and should be treated as temporary mitigations only. No evidence of a workaround that substitutes for the patch is available in the provided data.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today