Which versions of Server are affected by EUVD-2026-15553?

Organizations using Authorization bypass through User-Controlled key vulnerability in HYPR Server should be aware of moderate risk from CVE-2026-2414, a IDOR vulnerability rated CVSS 5.6.. A patch is available.

How to fix or mitigate EUVD-2026-15553?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Server EUVD-2026-15553

Q: What is the CVSS score of EUVD-2026-15553?

EUVD-2026-15553 has a CVSS 4.0 base score of 5.6 (Medium). CVSS vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-2414 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-25 HYPR

GHSA-m6wh-6x2c-qqwh

Privilege Escalation Authentication Bypass Server

5.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.6 MEDIUM

CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

10.7.2

EUVD ID Assigned

Mar 25, 2026 - 17:17 euvd

EUVD-2026-15553

Analysis Generated

Mar 25, 2026 - 17:17 vuln.today

CVE Published

Mar 25, 2026 - 17:03 nvd

MEDIUM 5.6

DescriptionCVE.org

Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.

AnalysisAI

A user-controlled key authorization bypass vulnerability in HYPR Server versions 9.5.2 through 10.7.1 enables authenticated attackers to escalate privileges through improper authorization checks. An attacker with low-level privileges can manipulate cryptographic keys or authorization tokens to gain high-level access, compromising confidentiality, integrity, and availability of the authentication system. This vulnerability requires local or physical access to the system and valid user credentials, limiting its immediate threat scope but representing a critical risk in multi-tenant or shared infrastructure deployments.

Technical ContextAI

The vulnerability stems from CWE-639 (Authorization Bypass Through User-Controlled Key), a root cause involving improper validation of user-supplied cryptographic material or authorization parameters. HYPR Server (cpe:2.3:a:hypr:server:*:*:*:*:*:*:*:*), an authentication and identity management platform, fails to properly validate or restrict how authenticated users can influence key material used in privilege decisions. Rather than deriving authorization levels from immutable server-side sources, the system allows users to supply or modify key values that directly influence access control decisions. This is particularly dangerous in zero-trust or passwordless authentication contexts where HYPR operates, as it undermines the cryptographic assurances these systems depend upon.

RemediationAI

Immediately upgrade HYPR Server to version 10.7.2 or later, which contains the fix for this authorization bypass vulnerability. Refer to https://www.hypr.com/trust-center/security-advisories for detailed upgrade procedures and release notes. For organizations unable to patch immediately, implement compensating controls: restrict administrative console and API access to trusted networks only, enforce multifactor authentication for all HYPR administrative accounts, audit and monitor all privilege escalation attempts and authorization token issuance, and segregate HYPR Server instances in air-gapped or heavily monitored environments if possible. Review audit logs for any evidence of exploitation (privilege escalation events or unauthorized key modifications) prior to patching. Post-patch, validate that authorization decisions now correctly refuse user-controlled key manipulation through security testing.