Description

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a standard local process within the same Windows session to decrypt the protected vault files and export the entire password manager contents in cleartext.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-02T20:17:36.877Z",
  "pubdate": "2026-09-02T20:17:36.877Z",
  "executiveSummary": "UpSignOn for Windows versions prior to 7.19.0 are affected by an insecure credential storage vulnerability related to the Windows PasswordVault API.\nThe vulnerability allows a local attacker to retrieve the biometric unlock key without triggering the expected biometric or user authentication prompts.\nBy accessing this key, an attacker can decrypt the application's protected vault files, leading to the full exposure of all stored credentials in cleartext.\nThe issue stems from improper implementation of the Windows PasswordVault API, which fails to enforce secure access controls on the stored key material.\nExploitation requires the attacker to be authenticated as a local user on the target Windows system within the same session as the victim.\nGiven the severity, this vulnerability presents a critical risk to the confidentiality of all secrets managed by the application.",
  "technicalDetails": "The vulnerability resides in the way UpSignOn handles the retrieval of biometric unlock keys using the Windows PasswordVault API. In affected versions (pre-7.19.0), the application fails to adequately protect the key material associated with biometric authentication.\nThe root cause is an insecure API interaction where the biometric unlock key is accessible to any standard local process operating within the same Windows user session. Because the implementation does not explicitly require a user presence or biometric verification challenge when querying the PasswordVault API for this specific key, the operating system permits the retrieval of the key silently.\nThe attack flow proceeds as follows: 1. An attacker gains access to a standard user account on the target machine. 2. Once the victim has established a session, the attacker executes a malicious process within that same security context. 3. The attacker's process queries the Windows PasswordVault API to retrieve the stored biometric key used by UpSignOn. 4. Due to the lack of restrictive access descriptors or enforcement of UI-based authentication prompts, the API returns the sensitive key material to the unauthorized process. 5. The attacker utilizes this retrieved key to perform cryptographic operations on the application's local vault files. 6. By successfully decrypting the vault, the attacker obtains the complete database of stored credentials in cleartext, resulting in total data exfiltration.\nThis vulnerability is localized to the workstation and does not require elevated administrative privileges, provided the attacker can execute code within the victim's session. There is no requirement for network exposure, as the entire exploitation process occurs locally on the affected host. The post-exploitation impact is catastrophic, as it bypasses the primary security barrier (the biometric unlock) designed to protect the user's password database."
}