Description

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-02T20:17:36.720Z",
  "pubdate": "2026-09-02T20:17:36.720Z",
  "executiveSummary": "UpSignOn for Windows versions prior to 7.19.0 are susceptible to a sensitive data exposure vulnerability involving insecure memory management of cryptographic artifacts.\nThe vulnerability allows local attackers with sufficient privileges to extract a retained backup key directly from the process memory of UpSignOn.exe, even after the user has explicitly re-locked the vault.\nBy leveraging this backup key, an attacker can decrypt the encrypted master password stored in v6-vault1.DATA.txt.\nSuccessful exploitation results in the complete compromise of the vault, enabling the unauthorized export of all stored credentials in cleartext.\nThis vulnerability poses a critical risk to data confidentiality, as it bypasses the security controls intended to protect the vault while in a locked state.\nThe attack is confined to local exploitation, requiring the adversary to have the ability to inspect the memory space of the running UpSignOn.exe process.",
  "technicalDetails": "The root cause of this vulnerability is the improper sanitization of sensitive cryptographic material in process memory. Specifically, UpSignOn for Windows fails to clear or securely wipe the backup key from the process address space of UpSignOn.exe after the primary vault operations have concluded or upon transition to a locked state.\nThe exploitation flow begins with the attacker identifying a running instance of UpSignOn.exe. Because the application retains the backup key in volatile memory, the attacker utilizes memory acquisition tools or debugging interfaces to perform a heap or process memory dump of the UpSignOn.exe process.\nWithin the memory dump, the attacker isolates the backup key, which is used to protect the master password backup. This backup is persistently stored on disk in the file v6-vault1.DATA.txt.\nOnce the key is extracted from memory, the attacker applies it to the encrypted v6-vault1.DATA.txt file. This action decrypts the master password, which provides the necessary authentication token to unlock the main user vault.\nFollowing the recovery of the master password, the attacker can programmatically interact with the UpSignOn vault storage or interface to decrypt the vault contents in their entirety. This results in the exposure of all stored credentials, including usernames, passwords, and sensitive metadata, which can then be exfiltrated in cleartext.\nThe vulnerability affects UpSignOn for Windows versions prior to 7.19.0. It requires local access to the target machine and sufficient privileges to read the memory space of the target process, typically equating to user-level access on a shared or compromised workstation. The exploitation does not require network interaction, as the entire attack vector is contained within the local execution environment.\nPost-exploitation, the attacker possesses the master password, allowing for persistent unauthorized access to the victim's vault regardless of future re-locking events, unless the master password itself is changed."
}