CVE-2026-75136: UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users of UpSignOn for Windows before 7.19.0 are exposed when an attacker can run a standard local process in the same Windows session. The described attack does not require an authentication prompt.
What access does an attacker need to extract the password manager contents?
The attacker needs local, low-privileged access and execution within the victim's active Windows session. They can retrieve the biometric unlock key from the Windows PasswordVault API, decrypt protected vault files, and export password manager contents in cleartext.
Are confidentiality and integrity affected?
Yes. The vulnerability can expose the entire password manager contents in cleartext, affecting confidentiality, and the supplied severity vector indicates low integrity impact. No availability impact is indicated.