Improper input validation in Windows Hello enables an authorized user to circumvent the biometric or PIN verification that protects access to credentials, effectively bypassing the local security feature. The flaw is rooted in an unchecked input handling routine, classified as input validation failure. By exploiting this weakness, an attacker can enjoy unauthorized access to protected resources or processes that would otherwise require valid Windows Hello authentication.

Microsoft Windows 10 releases 21H2 and 22H2, as well as Windows 11 releases 22H3, 23H2, 24H2, 25H2, and 26H1 are susceptible. The vulnerability spans both x86/x64 and arm64 architectures, covering the majority of consumer and enterprise builds listed in the vendor’s update guide.

The severity score indicates moderate risk, and current evidence shows no widespread exploitation. The condition requires local, authorized access, meaning an attacker must already be present on the system. Nonetheless, bypassing Windows Hello can allow privilege escalation or access to otherwise protected accounts, elevating the risk within a local environment.