The vulnerability is a missing authentication flaw in a critical function of HYPR Passwordless on Windows. Attackers can invoke this function without credentials, allowing them to intercept user credentials and potentially gain unauthorized access. The weakness falls under CWE-306, indicating that the application fails to enforce proper authentication checks for a sensitive operation. The impact is significant because it permits credential compromise, which can lead to broader system compromise if the stolen credentials have elevated privileges.

The affected product is HYPR Passwordless, with vulnerable versions defined only as those prior to 11.1.1. Any installation of the application before this version on Windows machines is subject to the missing authentication issue.

The CVSS score of 6.7 indicates a moderate to high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. The attack likely requires the attacker to have local access or some credential to deploy the function, as the flaw permits use of a critical feature without authentication. Given the lack of publicly observed exploits, the risk is moderate, but the potential for credential interception remains high for affected users.