CVE-2026-75136
UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.
| CWE | CWE-522 |
| Vendor | septeo it solutions |
| Product | upsignon |
| Published | Sep 2, 2026 |
| Last Updated | Sep 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for septeo it solutions upsignon
Be the first to know when new medium vulnerabilities affecting septeo it solutions upsignon are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
Septeo IT Solutions / UpSignOn
0 < 7.19.0
References
Credits
Elymaro (Aurélien Bourdois)