Biometric Keys Stored in Windows Credential Manager Are Accessible to Unprivileged Processes

CVE-2023-27706

What is CVE-2023-27706?

The Bitwarden Windows desktop application prior to version 2023.4.0 contains a security misconfiguration that results in biometric keys being stored in the Windows Credential Manager. This storage mechanism makes these keys vulnerable to unauthorized access by other local processes that lack the appropriate privileges, potentially exposing sensitive user data to risk. Users of the affected versions are urged to update to the latest version to secure their biometric authentication data.

References