UpSignOn for Windows before version 7.19.0 stores a biometric unlock key in the Windows PasswordVault API without enforcing authentication. A local attacker with access to the same Windows session can read this key through a standard local process, decrypt the protected vault files, and export all password manager contents in cleartext. This vulnerability enables the exfiltration of credentials and sensitive data previously protected by the application.

The affected product is Septeo IT Solutions’ UpSignOn for Windows versions earlier than 7.19.0. All installations of UpSignOn 7.18.x and earlier running on Windows are vulnerable; newer releases are not affected.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The asset requires local access; remote exploitation is not possible. Because the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain, but the potential impact of compromising all vault contents warrants attention. Exploitation does not require special privileges beyond those of the local user process, making it relatively easy for a malicious local user to obtain the biometric key and the stored passwords.