CVE-2026-75136
UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 2, 2026
- Updated
- Sep 3, 2026
- Reserved
- Aug 17, 2026
Description
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-522 Insufficiently Protected Credentials
Affected Products
| Product | Versions |
|---|---|
UpSignOnSepteo IT Solutions |
|
References
- Release Notesrelease-notes
- https://www.vulncheck.com/advisories/upsignon-biometric-key-exposure-via-windows-passwordvaultthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.