Windows Hello contains an input validation flaw that permits an attacker to send malformed data over a network, enabling a bypass of the biometric authentication process. This flaw allows unauthorized users to circumvent the standard Windows Hello security boundary, potentially gaining access without proper credential verification. The weakness aligns with the Input Validation category (CWE‑20).

The vulnerability affects Microsoft Windows Server products from 2016 through 2025, including the standard and Server Core editions for 2016, 2019, 2022 (23H2), and 2025. Windows Hello on these server editions is the component impacted by the flaw.

The CVSS score of 8.7 indicates a high impact on confidentiality, integrity, and availability, with a medium-to-high Exploitability rating. The description specifies a network‑based attack vector; an attacker only needs network access to the target to supply the crafted input, and no elevated local privileges are required. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but given its high severity and network delivery, the risk to exposed services is significant.