Improper certificate validation in Windows Hello permits an authorized local attacker to bypass the authentication process, allowing the attacker to gain authorization that would normally require proper biometric or PIN verification. This weakness can lead to unauthorized use of system resources and potential privilege escalation within local contexts.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1, as well as Microsoft Windows Server 2019, Server 2022, and Server 2025 in both standard and Server Core installations. The vulnerability exists on both x86 and x64 architectures as well as ARM64-based systems.

The CVSS score of 4.4 reflects a low severity impact, and the EPSS score is not available, indicating no known widespread exploitation. This issue is not listed in the CISA KEV catalog. The attack requires local authorized access to the target machine; the attacker must be a legitimate user to exploit certificate validation failures. Once bypassed, Windows Hello no longer enforces the intended authentication barrier, creating a local bypass that could be leveraged for further malicious activity on the machine.