HYPR Passwordless EUVD-2026-100756

Requires an attacker with existing local, low-privileged authenticated access to a Windows host running a vulnerable HYPR Passwordless version (any release before 11.3.3). Exploitation hinges on the product using a user-controlled key/identifier to make an authorization decision (CWE-639 insecure direct object reference); the attacker substitutes or tampers with that key to reference a resource belonging to another or higher-privileged principal. Limiting factors that reduce real-world risk: the attack vector is local (AV:L) with no network reach, it needs valid low-privilege credentials/foothold (PR:L), no user interaction of a victim is required (UI:N), and only versions prior to 11.3.3 are affected (patched installs are not exposed).

This is a moderate-risk local privilege escalation (CVSS 4.0 base 6.9, Medium) rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) is internally consistent with the CWE-639 (authorization bypass through user-controlled key / IDOR) classification and the 'Privilege Escalation' framing: the attacker must already have local access and low privileges (PR:L), and the primary damage is high confidentiality impact with only limited integrity/availability effect. No EPSS score, KEV listing, SSVC decision, or public POC was provided in the intelligence set, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict: a local-only, authentication-required flaw naturally correlates with low mass-exploitation likelihood, and the absence of KEV/EPSS is consistent with that. The key mitigating fact is that a vendor patch is available (HYPR advisory / fixed in 11.3.3), making this a straightforward patch-management item rather than a fire drill. Missing data to note: no EPSS probability and no explicit POC status were supplied, so widespread-exploitation likelihood cannot be quantified from the input.

A low-privileged local user of HYPR Passwordless on a Windows host manipulates a user-controlled identifier (key) that the product uses for authorization, causing it to act on another user's or a higher-privileged resource. Because the authorization decision trusts attacker-supplied input, the user escalates their effective privileges on the system. No public exploit code was identified in the provided data, and the attack requires existing local low-privileged access rather than remote network reach.