OMEN Gaming Hub EUVD-2026-63971

The attacker must hold an active local session on the targeted Windows host - the AV:L vector confirms remote network exploitation is not possible. Standard low-privilege Windows credentials are sufficient; no administrative account or special group membership is required (PR:L in CVSS 4.0). OMEN Gaming Hub must be installed and running, which is the default state on HP OMEN gaming laptops and desktops. No non-default configuration is required. Exploitation is constrained to endpoints where the attacker already has interactive or remote-desktop access, which is the primary limiting factor defenders should weigh when prioritizing remediation.

The CVSS 4.0 score of 8.2 (AV:L/AC:L/AT:N/PR:L/UI:N) correctly frames this as a local, low-complexity attack requiring only standard user credentials - it is not remotely exploitable over a network. The scope-change signals (SC:H alongside VC:H) indicate successful exploitation can affect components beyond the vulnerable service itself, consistent with gaining OS-level elevated context. The confidentiality-only impact profile (no VI or SI) is atypical for a privilege escalation and may suggest the primary risk is unauthorized access to protected configuration data or credentials rather than arbitrary code execution; defenders should verify with the HP advisory whether full code execution is achievable post-escalation. EPSS data is absent from available intelligence, so exploitation probability cannot be quantified numerically. The vulnerability has no CISA KEV listing and no confirmed public exploit at time of analysis. The JWT forgery class is mechanically well-understood, which historically shortens time-to-exploit once a flaw is disclosed, but the local-only attack vector significantly limits automated or opportunistic mass exploitation.

A low-privileged local user on an HP OMEN gaming system crafts a JWT with escalated privilege claims, omitting or substituting the signature field. The user submits this forged token to the OMEN Gaming Hub service's IPC endpoint; because the service does not verify the cryptographic signature, it honors the inflated claims and grants the attacker access to privileged hardware control functions or the elevated OS context under which the hub runs.