Description
Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.

This issue affects HYPR Passwordless: before 11.3.3.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an authorization bypass triggered by a user‑controlled key in HYPR Passwordless on Windows. Attackers can manipulate this key to acquire elevated privileges, allowing them to perform actions normally restricted to administrators and compromising system integrity and confidentiality.

Affected Systems

HYPR Passwordless for Windows, versions prior to 11.3.3.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% shows a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting it has not been widely exploited in the wild. The likely attack vector is local; an attacker who can alter the user‑controlled key within the application can bypass authorization checks and gain privileges.

Generated by OpenCVE AI on October 16, 2026 at 01:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade HYPR Passwordless to version 11.3.3 or later, which contains the fix for the user‑controlled key issue.
  • Disable or remove any user‑controlled keys that grant administrative privileges unless absolutely required.
  • Review and tighten key management policies to ensure that privileged keys are protected by appropriate access controls and monitoring.

Generated by OpenCVE AI on October 16, 2026 at 01:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Hypr
Hypr passwordless
Vendors & Products Hypr
Hypr passwordless

Fri, 16 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Title Authorization Bypass via User‑Controlled Key in HYPR Passwordless Enables Privilege Escalation

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Title Authorization Bypass via User‑Controlled Key Enabling Privilege Escalation in HYPR Passwordless
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Title Authorization Bypass via User‑Controlled Key Enabling Privilege Escalation in HYPR Passwordless

Tue, 13 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3.
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Hypr Passwordless
cve-icon MITRE

Status: PUBLISHED

Assigner: HYPR

Published:

Updated: 2026-10-14T18:08:43.330Z

Reserved: 2026-07-10T21:26:58.957Z

Link: CVE-2026-15468

cve-icon Vulnrichment

Updated: 2026-10-14T18:08:37.682Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T23:17:32.437

Modified: 2026-10-16T20:02:37.630

Link: CVE-2026-15468

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T15:45:10Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key